CVE-2026-84740 PUBLISHED

The Events Calendar 6.12.0 - 6.17.5 - Unauthenticated Arbitrary Shortcode Execution via 'view_data' Parameter

Assigner: WPScan
Reserved: 02.09.2026 Published: 02.10.2026 Updated: 02.10.2026

The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an unauthenticated AJAX action before merging it into its rendering context, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS Score: 6.5

Product Status

Vendor Unknown
Product The Events Calendar
Versions Default: unaffected
  • affected from 6.12.0 to 6.17.5.1 (excl.)

Credits

  • Jakub Herman finder
  • WPScan coordinator

References

Problem Types

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE