---
title: "StellarWP The Events Calendar vulnerabilities and CVEs"
url: https://radicalnotion.ai/vendor/stellarwp/the-events-calendar
type: product
description: "StellarWP The Events Calendar has 26 published CVEs, 0 in CISA KEV and 4 with public exploits."
updated: 2026-09-12
source: RadicalNotion.AI
license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/)
---

# StellarWP The Events Calendar vulnerabilities

Vendor: [StellarWP](https://radicalnotion.ai/vendor/stellarwp)

- **Published CVEs:** 26
- **In CISA KEV:** 0
- **With a public exploit:** 4
- **With a patch:** 26
- **Average CVSS:** 6.4
- **First CVE:** 2019-08-21
- **Latest CVE:** 2026-09-12

## Severity breakdown

| Severity | CVEs |
| --- | --- |
| Critical | 4 |
| High | 5 |
| Medium | 17 |
| Low | 0 |
| Unscored | 0 |

## Most common weakness types

| CWE | Name | CVEs |
| --- | --- | --- |
| [CWE-79](https://radicalnotion.ai/cwe/cwe-79) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 6 |
| [CWE-862](https://radicalnotion.ai/cwe/cwe-862) | Missing Authorization | 6 |
| [CWE-89](https://radicalnotion.ai/cwe/cwe-89) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 3 |
| [CWE-352](https://radicalnotion.ai/cwe/cwe-352) | Cross-Site Request Forgery (CSRF) | 3 |
| [CWE-697](https://radicalnotion.ai/cwe/cwe-697) | Incorrect Comparison | 1 |
| [CWE-200](https://radicalnotion.ai/cwe/cwe-200) | Exposure of Sensitive Information to an Unauthorized Actor | 1 |
| [CWE-94](https://radicalnotion.ai/cwe/cwe-94) | Improper Control of Generation of Code ('Code Injection') | 1 |
| [CWE-22](https://radicalnotion.ai/cwe/cwe-22) | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 1 |

## CVEs by year

| Year | CVEs published |
| --- | --- |
| 2019 | 1 |
| 2020 | 0 |
| 2021 | 0 |
| 2022 | 0 |
| 2023 | 1 |
| 2024 | 7 |
| 2025 | 11 |
| 2026 | 6 |

## Affected versions (top 24 of 45)

| Version | Kind | CVEs |
| --- | --- | --- |
| \< 6.6.4 | range | 2 |
| \<= 6.15.9 | range | 2 |
| \< 4.8.2 | range | 1 |
| \< 5.14.0.4 | range | 1 |
| \< 6.13.2.1 | range | 1 |
| \< 6.2.8.1 | range | 1 |
| \< 6.4.0.1 | range | 1 |
| \< 6.6.4.1 | range | 1 |
| \< 6.8.2.1 | range | 1 |
| \<= 6.11.2.1 | range | 1 |
| \<= 6.13.2 | range | 1 |
| \<= 6.15.1 | range | 1 |
| 6.6.4 | patched | 2 |
| 4.8.2 | patched | 1 |
| 5.14.0.4 | patched | 1 |
| 6.12.0 | patched | 1 |
| 6.13.2.1 | patched | 1 |
| 6.15.13 | patched | 1 |
| 6.2.8.1 | patched | 1 |
| 6.3.1 | patched | 1 |
| 6.4.0.1 | patched | 1 |
| 6.5.1.5 | patched | 1 |
| 6.6.4.1 | patched | 1 |
| 6.7.1 | patched | 1 |

## CVEs

| CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch |
| --- | --- | --- | --- | --- | --- | --- |
| CVE-2026-78159 | The Events Calendar \<= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation | critical | 9.8 | No | No | Yes |
| CVE-2026-78006 | The Events Calendar \<= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution | critical | 9.8 | No | No | Yes |
| CVE-2026-3585 | The Events Calendar \<= 6.15.17 - Authenticated (Author+) Arbitrary File Read via ajax\_create\_import | high | 7.5 | No | No | Yes |
| CVE-2026-2694 | The Events Calendar \<= 6.15.16 - Improper Authorization to Authenticated (Contributor+) Event/Organizer/Venue Update/Trash via REST API | medium | 5.4 | No | No | Yes |
| CVE-2025-15043 | The Events Calendar \<= 6.15.13 - Missing Authorization to Authenticated (Subscriber+) Data Migration Control | medium | 5.4 | No | No | Yes |
| CVE-2025-69352 | WordPress The Events Calendar plugin \<= 6.15.12.2 - Broken Access Control vulnerability | medium | 5.4 | No | No | Yes |
| CVE-2025-12192 | The Events Calendar \<= 6.15.9 - Sysinfo Key Incorrect Comparison to Unauthenticated Sensitive Information Exposure | medium | 5.3 | No | No | Yes |
| CVE-2025-12197 | The Events Calendar 6.15.1.1 - 6.15.9 - Unauthenticated SQL Injection via s | high | 7.5 | No | No | Yes |
| CVE-2025-12175 | The Events Calendar \<= 6.15.9 - Missing Authorization to Authenticated (Subscriber+) Draft Event Title/QR Code Exposure | medium | 4.3 | No | No | Yes |
| CVE-2025-9808 | The Events Calendar \<= 6.15.2 - Missing Authorization to Unauthenticated Password-Protected Information Disclosure | medium | 5.3 | No | No | Yes |
| CVE-2025-9807 | The Events Calendar \<= 6.15.1 - Unauthenticated SQL Injection | high | 7.5 | No | No | Yes |
| CVE-2025-5144 | The Events Calendar \<= 6.13.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting | medium | 6.4 | No | No | Yes |
| CVE-2025-48246 | WordPress The Events Calendar plugin \<= 6.11.2.1 - Broken Access Control Vulnerability | medium | 5.4 | No | No | Yes |
| CVE-2024-8493 | The Events Calendar \< 6.6.4 - Admin+ Stored XSS | medium | 4.8 | No | Yes | Yes |
| CVE-2025-24537 | WordPress The Events Calendar plugin \<= 6.7.0 - Cross Site Request Forgery (CSRF) vulnerability | medium | 5.4 | No | No | Yes |
| CVE-2024-12118 | The Events Calendar \<= 6.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting | medium | 6.4 | No | No | Yes |
| CVE-2024-37518 | WordPress The Events Calendar plugin \<= 6.5.1.4 - Cross Site Request Forgery (CSRF) vulnerability | medium | 4.3 | No | No | Yes |
| CVE-2024-5333 | The Events Calendar \< 6.8.2.1 - Unauthenticated Password Protected Event Disclosure | medium | 5.3 | No | Yes | Yes |
| CVE-2022-4974 | Freemius SDK \<= 2.4.2 - Missing Authorization Checks | medium | 6.3 | No | No | Yes |
| CVE-2024-6931 | The Events Calendar \<= 6.6.3 - Unauthenticated Stored Cross-Site Scripting | high | 7.2 | No | No | Yes |
| CVE-2024-8275 | The Events Calendar \<= 6.6.4 - Unauthenticated SQL Injection | critical | 9.8 | No | No | Yes |
| CVE-2024-4180 | The Events Calendar \< 6.4.0.1 - Reflected XSS | critical | 9.1 | No | Yes | Yes |
| CVE-2024-31433 | WordPress The Events Calendar plugin \<= 6.3.0 - Cross Site Request Forgery (CSRF) vulnerability | medium | 4.3 | No | No | Yes |
| CVE-2023-6557 | The Events Calendar \<= 6.2.8.2 - Unauthenticated Sensitive Information Exposure | medium | 5.3 | No | No | Yes |
| CVE-2023-6203 | The Events Calendar \< 6.2.8.1 - Unauthenticated Arbitrary Password Protected Post Read | high | 7.5 | No | Yes | Yes |
| CVE-2019-15109 | - | medium | 6.1 | No | No | Yes |

## Frequently asked questions

### How many CVEs does StellarWP The Events Calendar have?

StellarWP The Events Calendar has 26 published CVE records since 2019.

### How many StellarWP The Events Calendar CVEs are in CISA KEV?

None of StellarWP The Events Calendar's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

### Are there public exploits for StellarWP The Events Calendar vulnerabilities?

Yes — 4 of StellarWP The Events Calendar's CVEs have a known public exploit.

### Which versions of StellarWP The Events Calendar are affected?

45 distinct StellarWP The Events Calendar versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

### What are the most common weakness types in StellarWP The Events Calendar CVEs?

StellarWP The Events Calendar's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-862 (Missing Authorization), CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')), CWE-352 (Cross-Site Request Forgery (CSRF)).

### How many critical StellarWP The Events Calendar vulnerabilities are there?

StellarWP The Events Calendar has 4 critical and 5 high-severity CVEs.

### What is the average severity of StellarWP The Events Calendar CVEs?

The average CVSS base score across StellarWP The Events Calendar's scored CVEs is 6.4.

## Other products from this vendor

- [GiveWP – Donation Plugin and Fundraising Platform](https://radicalnotion.ai/vendor/stellarwp/givewp-donation-plugin-and-fundraising-platform) (34 CVEs)
- [Kadence Blocks — Page Builder Toolkit for Gutenberg Editor](https://radicalnotion.ai/vendor/stellarwp/kadence-blocks-page-builder-toolkit-for-gutenberg-editor) (30 CVEs)
- [Event Tickets and Registration](https://radicalnotion.ai/vendor/stellarwp/event-tickets-and-registration) (8 CVEs)
- [GiveWP](https://radicalnotion.ai/vendor/stellarwp/givewp) (8 CVEs)
- [LearnDash LMS](https://radicalnotion.ai/vendor/stellarwp/learndash-lms) (7 CVEs)
- [Membership Plugin – Restrict Content](https://radicalnotion.ai/vendor/stellarwp/membership-plugin-restrict-content) (7 CVEs)
- [WPComplete](https://radicalnotion.ai/vendor/stellarwp/wpcomplete) (4 CVEs)
- [Bookit — Booking & Appointment Calendar](https://radicalnotion.ai/vendor/stellarwp/bookit-booking-and-appointment-calendar) (3 CVEs)

---

Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/stellarwp/the-events-calendar). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.