Veille CVE

Recherche « Unknown The Events Calendar »

21 CVE

Critique 0 Élevée 4 Moyenne 10 Faible 7 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown The Events Calendar » ✕
  1. CVE-2026-102499 7.7 Élevée

    Unknown Modern Events Calendar Lite · Unknown Modern Event Calendar Pro

    The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL queries into already existing queries and extract sensitive data from the database.

  2. CVE-2026-96534 7.7 Élevée

    Unknown Modern Events Calendar Lite · Unknown Modern Event Calendar Pro

    The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing authenticated users with minimal privileges (Subscriber and above) to perform SQL injection attacks.

  3. CVE-2026-110070 6.5 Moyenne

    Unknown Modern Events Calendar Lite

    The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it, allowing authenticated users with the Subscriber role to modify the title, content, and excerpt of arbitrary posts, pages, and custom post types created by other users.

  4. CVE-2026-110069 4.3 Moyenne

    Unknown Modern Events Calendar Lite

    The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks before returning event booking and attendee data, allowing any authenticated user, including Subscribers, to disclose the names, email addresses, transaction IDs and payment amounts of every booking on the site.

  5. CVE-2026-84740 6.5 Moyenne

    Unknown The Events Calendar

    The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an unauthenticated AJAX action before merging it into its rendering context, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.

  6. CVE-2026-84743 3.8 Faible

    Unknown The Events Calendar

    The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, allowing users with a low-privilege role such as contributor to modify, unpublish, trash and take ownership of records belonging to other users, including administrators.

  7. CVE-2026-84742 2.7 Faible

    Unknown The Events Calendar

    The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it through its REST API, allowing users with a role that cannot normally publish, such as contributor, to publish content directly and bypass editorial review.

  8. CVE-2026-84741 5.3 Moyenne

    Unknown The Events Calendar

    The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response, allowing unauthenticated users to read the contents of records that have never been published.

  9. CVE-2026-77705 7.2 Élevée

    Unknown Booking for Appointments and Events Calendar

    The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's customer or employee management permissions to set the password and email address of other users' WordPress accounts and take them over.

  10. CVE-2026-77689 5.3 Moyenne

    Unknown Booking for Appointments and Events Calendar

    The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway. This lets an unauthenticated attacker obtain confirmed, fully paid appointments and events without any payment being collected.

  11. CVE-2026-84745 2.7 Faible

    Unknown The Events Calendar

    The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site, including other users'.

  12. CVE-2026-14215 6.5 Moyenne

    Unknown Booking for Appointments and Events Calendar

    The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token before running the post-booking action chain, allowing an unauthenticated user to trigger booking notifications and integration callbacks for a booking by enumerating its identifier.

  13. CVE-2026-77704 2.7 Faible

    Unknown Booking for Appointments and Events Calendar

    The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them change an appointment's status, allowing customers to set arbitrary statuses on appointments they are booked on, including approving their own bookings that were left awaiting approval and overwriting another customer's booking status on a shared appointment.

  14. CVE-2026-14216 6.5 Moyenne

    Unknown Booking for Appointments and Events Calendar

    The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks.

  15. CVE-2026-14212 4.7 Moyenne

    Unknown Booking for Appointments and Events Calendar

    The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee (provider) owns the provider account being updated, allowing any employee with an Employee Panel login to overwrite another employee's cabinet password and take over their account.

  16. CVE-2026-14213 3.7 Faible

    Unknown Booking for Appointments and Events Calendar

    The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee (provider) is assigned to the appointment being accessed, allowing any employee to read any appointment by its identifier and disclose the booked customer's personal data.

  17. CVE-2026-14211 3.8 Faible

    Unknown Booking for Appointments and Events Calendar

    The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee (provider) is related to the customer whose record is being accessed, allowing any employee with an Employee Panel login to read and modify the stored personal data of any customer by enumerating sequential identifiers.

  18. CVE-2026-16536 5.3 Moyenne

    Unknown Simple Google Calendar Outlook Events Widget

    The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 does not validate a user-supplied URL before performing a server-side request, allowing unauthenticated attackers to perform Server-Side Request Forgery attacks and, in some cases, read the response of the internal request.

  19. CVE-2026-14214 2.7 Faible

    Unknown Booking for Appointments and Events Calendar

    The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allowing a user with the Amelia Manager role to modify arbitrary columns of any stored user record by supplying them in the import request.

  20. CVE-2026-13390 5.3 Moyenne

    Unknown The Events Calendar

    The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity check for a particular status value, allowing unauthenticated attackers to mark existing import records as failed and to store arbitrary content in a hidden comment record.

  21. CVE-2026-11349 8.6 Élevée

    Unknown Modern Event Calendar Pro · Unknown Modern Events Calendar Lite

    The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request parameter before using it in a SQL statement, through an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection vulnerability that allows attackers to extract sensitive data from the database.