the-events-calendar vulnerabilities
CVEs whose affected-version data names the the-events-calendar package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-110903Medium· 6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a throu…
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a throu…
▾ SunlitLiquid Web / StellarWP · the-events-calendarEPSS 0.13%via NVD
CVE-2026-95606Critical· 9.8Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP The Events Calendar allows Object Injection. This issue affects The Events Calendar: from n/a through 6.17.4.
Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP The Events Calendar allows Object Injection. This issue affects The Events Calendar: from n/a through 6.17.4.
▾ MidnightLiquid Web / StellarWP · the-events-calendarEPSS 0.32%via NVD
CVE-2026-97285Medium· 5.4Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions.
Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions.
▾ SunlitNexcess · the-events-calendarEPSS 0.20%via NVD