Liquid Web / StellarWP The Events Calendar vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Liquid Web / StellarWP The Events Calendar: 3 record(s), with affected versions and fixes.

CVE-2026-110903 Medium · 6.5 CWE-79 Oct 16, 2026

WordPress The Events Calendar plugin <= 6.18.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through 6.18.1.

CVE-2026-95606 Critical · 9.8 CWE-502 Oct 7, 2026

WordPress The Events Calendar plugin <= 6.17.4 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP The Events Calendar allows Object Injection. This issue affects The Events Calendar: from n/a through 6.17.4.

CVE-2026-49772 Critical · 9.3 CWE-89 Jun 16, 2026

WordPress The Events Calendar plugin 6.15.12-6.16.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP The Events Calendar allows Blind SQL Injection. This issue affects The Events Calendar: from 6.15.12 through 6.16.2.