tadrik Free store check

Plugin security / The Events Calendar

The Events Calendar vulnerability: is your WooCommerce store affected?

The Events Calendar has 11 serious security holes rated 7 or higher out of 10 that someone can use with no login or with only a customer account. The newest was published on 30 September 2026. Every one is fixed: update to 6.17.4.1 or newer.

Short answer: your store is affected if it runs The Events Calendar older than 6.17.4.1. Update to 6.17.4.1 or newer, on a copy of the store first if you can.

In our check of 3,600 live UK and US WooCommerce stores (31 October 2026 to 1 November 2026), 7 were running a version of The Events Calendar with a serious hole that already had a fix. How we checked.

The security holes

Newest first. Each one is published in a public security database and fixed in the version shown.

  1. PHP object injection

    In some setups, someone could make your server run code.

    Score 9.8 (critical)no login neededAffected: older than 6.17.4.1Fixed in 6.17.4.1Published 30 September 2026CVE-2026-95606

    Advisory: Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP The Events Calendar allows Object Injection.

  2. Code execution

    Someone could run their own code on your server.

    Score 9.8 (critical)no login neededAffected: older than 6.17.4.1Fixed in 6.17.4.1Published 11 September 2026CVE-2026-78006

    Advisory: The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the is_safe_widget_instance function.

  3. Code execution

    Someone could run their own code on your server.

    Score 9.8 (critical)no login neededAffected: older than 6.17.3.1Fixed in 6.17.3.1Published 11 September 2026CVE-2026-78159

    Advisory: The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function.

  4. PHP object injection

    In some setups, someone could make your server run code.

    Score 9.8 (critical)no login neededAffected: older than 6.17.3Fixed in 6.17.3Published 24 August 2026CVE-2026-78265

    Advisory: Unauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 versions.

  5. SQL injection

    Someone could read or change your database, which holds customer and order details.

    Score 9.3 (critical)no login neededAffected: older than 6.16.3Fixed in 6.16.3Published 8 June 2026CVE-2026-49772

    Advisory: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP The Events Calendar allows Blind SQL Injection.

  6. SQL injection

    Someone could read or change your database, which holds customer and order details.

    Score 7.5 (high)no login neededAffected: older than 6.15.10Fixed in 6.15.10Published 4 November 2025CVE-2025-12197

    Advisory: The The Events Calendar plugin for WordPress is vulnerable to blind SQL Injection via the 's' parameter in versions 6.15.1.1 to 6.15.9 due to insufficient escaping on the user supplied parameter and lack of...

  7. SQL injection

    Someone could read or change your database, which holds customer and order details.

    Score 7.5 (high)no login neededAffected: older than 6.15.1.1Fixed in 6.15.1.1Published 11 September 2025CVE-2025-9807

    Advisory: The The Events Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the ‘s’ parameter in all versions up to, and including, 6.15.1 due to insufficient escaping on the user supplied parameter...

  8. SQL injection

    Someone could read or change your database, which holds customer and order details.

    Score 9.8 (critical)no login neededAffected: older than 6.6.4.1Fixed in 6.6.4.1Published 24 September 2024CVE-2024-8275

    Advisory: The The Events Calendar plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tribe_has_next_event' function in all versions up to, and including, 6.6.4 due to insufficient escaping on...

  9. Cross-site scripting

    Someone could plant a script that runs in your visitors' or your admins' browsers.

    Score 9.1 (critical)no login neededAffected: older than 6.4.0.1Fixed in 6.4.0.1Published 14 May 2024CVE-2024-4180

    Advisory: The Events Calendar WordPress plugin before 6.4.0.1 does not properly sanitize user-submitted content when rendering some views via AJAX.

  10. Data exposure

    Information meant to stay private could be read.

    Score 7.5 (high)no login neededAffected: older than 6.2.8.1Fixed in 6.2.8.1Published 20 November 2023CVE-2023-6203

    Advisory: The Events Calendar WordPress plugin before 6.2.8.1 discloses the content of password protected posts to unauthenticated users via a crafted request

  11. Cross-site scripting

    Someone could plant a script that runs in your visitors' or your admins' browsers.

    Score 7.1 (high)no login neededAffected: older than 6.1.0Fixed in 6.1.0Published 18 July 202335d2f1e7-a4f8-49fd-a8dd-bb2c26710f93

    Advisory: The Freemius SDK for WordPress does not adequately sanitize inputs or escape outputs, leading to Reflected Cross-Site Scripting.

How to check your version

  1. Log in to WordPress and open Plugins > Installed Plugins.
  2. Find The Events Calendar. The version number is under its name. If it is lower than 6.17.4.1, your store is affected.
  3. No login to hand? Open https://yourstore.com/wp-content/plugins/the-events-calendar/readme.txt in a browser, with your own address in place of yourstore.com, and read the Stable tag line. Some hosts block this file; then use step 1.

How to fix it

  1. Make a backup, or better, a staging copy of the store (most hosts have a one-click staging button).
  2. On the copy, update The Events Calendar to 6.17.4.1 or newer: Dashboard > Updates, or Update now on the Plugins page.
  3. If no update shows, it may be a paid version whose licence has run out: download the new version from the seller's site and upload it.
  4. Place a test order on the copy: add to cart, check out, pay with a test method. Check the pages that use The Events Calendar.
  5. If everything works, make the same update on the live store and place one more test order.
  6. If you no longer use The Events Calendar, delete it instead of leaving it deactivated.

Not sure, or no time?

Get a free check of your store: we look at its public pages for plugins with known holes, and reply within one working day. Or we fix it for you: we update your store on a copy, place a test order, and only then change the live store, for a fixed £99 / $119.

Free store check Fix it for me on a copy

Questions

Which The Events Calendar version fixes it?
Version 6.17.4.1 or newer fixes all 11 issues on this page.
How do I know if my store is affected?
Your store is affected if it runs The Events Calendar older than 6.17.4.1. In WordPress, open Plugins and read the version under The Events Calendar. Without logging in, open yourstore.com/wp-content/plugins/the-events-calendar/readme.txt and read the Stable tag line.
I don't use The Events Calendar any more. Is a deactivated copy safe?
Deactivating it lowers the risk but leaves the old code on your server. If you don't use it, delete it; if you do, update it.
Can someone fix it for me?
Yes. We update the store on a copy first, place a test order, and only then make the same change on the live store, for a fixed price.

Vulnerability data: WPVulnerability (wpvulnerability.net, CC0), which links each entry to its CVE or advisory. Store numbers: Tadrik's own checks of public pages, aggregates only. Page updated 3 November 2026.