project

The Events Calendar

WordPress plugin for publishing and managing event listings and calendars, maintained by StellarWP.

Known aliases

Events Calendar plugin

Relationships

No evidence-backed relationships are recorded.

Current clusters

security1 publisher

An unapproved comment triggers RCE in The Events Calendar before moderation sees it

StellarWP split the fix across two releases, so a WordPress site updated on August 25 stayed open to CVE-2026-78006 until 6.17.4.1 shipped on September 10. Version data puts about 240,000 installs behind both bugs.

Publishers:securityweek.com

Reality

Evidence58
Adoption55
Hype gap+25
Incentives45
Confidence55

security2 publishers

Wordfence blocked 100,000 exploit attempts against a WooCommerce plugin with 6,000 installs

CVE-2026-27540 lets an unauthenticated request add php to the plugin's own upload allowlist and drop a webshell. The fix shipped on February 20, and the first exploitation spike came 104 days later, on June 4.

Publishers:bleepingcomputer.comthehackernews.com

Reality

Evidence68
Adoption55
Hype gap+20
Incentives65
Confidence70