+ 35 vulnerabilidades conocidas más
| CVE |
Vulnerabilidad |
Tipo |
Gravedad |
Afectadas |
Corregido en |
Publicado |
Estado |
|
CVE-2025-24537
|
The Events Calendar [the-events-calendar] < 6.7.1 |
Falsificación de petición en sitios cruzados (CSRF) |
Media
5,4
|
< 6.7.1
|
6.7.1 |
2025-01-09 |
✓ corregido en la última versión
|
|
CVE-2024-5333
|
The Events Calendar [the-events-calendar] < 6.8.2.1 |
Exposición de información sensible a un actor no autorizado |
Media
5,3
|
< 6.8.2.1
|
6.8.2.1 |
2024-11-25 |
✓ corregido en la última versión
|
|
CVE-2024-8275
|
The Events Calendar [the-events-calendar] < 6.6.4.1 |
Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) |
Crítica
9,8
|
< 6.6.4.1
|
6.6.4.1 |
2024-09-24 |
✓ corregido en la última versión
|
|
CVE-2024-6931
|
The Events Calendar [the-events-calendar] < 6.6.4 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
6,1
|
< 6.6.4
|
6.6.4 |
2024-07-23 |
✓ corregido en la última versión
|
|
CVE-2024-37518
|
The Events Calendar [the-events-calendar] < 6.5.1.5 |
Falsificación de petición en sitios cruzados (CSRF) |
Media
4,3
|
< 6.5.1.5
|
6.5.1.5 |
2024-07-05 |
✓ corregido en la última versión
|
|
CVE-2024-1295
|
The Events Calendar [the-events-calendar] < 6.4.0.1 |
Control de acceso incorrecto |
Media
6,5
|
< 6.4.0.1
|
6.4.0.1 |
2024-05-24 |
✓ corregido en la última versión
|
|
CVE-2024-4180
|
The Events Calendar [the-events-calendar] < 6.4.0.1 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Crítica
9,1
|
< 6.4.0.1
|
6.4.0.1 |
2024-05-14 |
✓ corregido en la última versión
|
|
CVE-2024-31433
|
The Events Calendar [the-events-calendar] < 6.3.1 |
Falsificación de petición en sitios cruzados (CSRF) |
Media
4,3
|
< 6.3.1
|
6.3.1 |
2024-04-10 |
✓ corregido en la última versión
|
|
CVE-2023-6557
|
The Events Calendar [the-events-calendar] < 6.2.9 |
Falta de control de autorización |
Media
5,3
|
< 6.2.9
|
6.2.9 |
2024-01-12 |
✓ corregido en la última versión
|
|
CVE-2023-6203
|
The Events Calendar [the-events-calendar] < 6.2.8.1 |
Autenticación indebida |
Alta
7,5
|
< 6.2.8.1
|
6.2.8.1 |
2023-12-18 |
✓ corregido en la última versión
|
|
—
|
The Events Calendar [the-events-calendar] < 6.2.8.1 |
— |
Desconocido
|
< 6.2.8.1
|
6.2.8.1 |
2023-11-22 |
✓ corregido en la última versión
|
|
—
|
The Events Calendar [the-events-calendar] < 6.2.8.1 |
— |
Desconocido
|
< 6.2.8.1
|
6.2.8.1 |
2023-11-20 |
✓ corregido en la última versión
|
|
—
|
The Events Calendar [the-events-calendar] < 3.0.1 |
— |
Desconocido
|
< 3.0.1
|
3.0.1 |
2023-08-01 |
✓ corregido en la última versión
|
|
CVE-2023-35777
|
The Events Calendar [the-events-calendar] < 6.1.3 |
Falta de control de autorización |
Media
5,3
|
< 6.1.3
|
6.1.3 |
2023-07-25 |
✓ corregido en la última versión
|
|
CVE-2023-33999
|
The Events Calendar [the-events-calendar] < 6.1.0 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Alta
7,1
|
< 6.1.0
|
6.1.0 |
2023-07-18 |
✓ corregido en la última versión
|
|
—
|
The Events Calendar [the-events-calendar] < 4.1.1.1 |
— |
Desconocido
|
< 4.1.1.1
|
4.1.1.1 |
2023-04-25 |
✓ corregido en la última versión
|
|
—
|
The Events Calendar [the-events-calendar] < 5.14.0.4 |
— |
Desconocido
|
< 5.14.0.4
|
5.14.0.4 |
2023-02-28 |
✓ corregido en la última versión
|
|
—
|
The Events Calendar [the-events-calendar] < 5.14.0.4 |
— |
Desconocido
|
< 5.14.0.4
|
5.14.0.4 |
2023-02-28 |
✓ corregido en la última versión
|
|
—
|
The Events Calendar [the-events-calendar] < 5.14.0.4 |
Falta de control de autorización |
Media
6,3
|
< 5.14.0.4
|
5.14.0.4 |
2022-03-04 |
✓ corregido en la última versión
|
|
—
|
The Events Calendar [the-events-calendar] < 5.14.0.4 |
— |
Desconocido
|
< 5.14.0.4
|
5.14.0.4 |
2022-02-28 |
✓ corregido en la última versión
|
|
—
|
The Events Calendar [the-events-calendar] < 5.14.0.4 |
— |
Desconocido
|
< 5.14.0.4
|
5.14.0.4 |
2022-02-28 |
✓ corregido en la última versión
|
|
CVE-2019-15109
|
The Events Calendar [the-events-calendar] < 4.8.2 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
6,1
|
< 4.8.2
|
4.8.2 |
2019-03-04 |
✓ corregido en la última versión
|
|
—
|
The Events Calendar [the-events-calendar] < 4.1.1.1 |
— |
Desconocido
|
< 4.1.1.1
|
4.1.1.1 |
2016-04-25 |
✓ corregido en la última versión
|
|
—
|
The Events Calendar [the-events-calendar] < 4.1.1.1 |
— |
Desconocido
|
< 4.1.1.1
|
4.1.1.1 |
2016-04-25 |
✓ corregido en la última versión
|
|
—
|
The Events Calendar [the-events-calendar] < 3.0.1 |
— |
Desconocido
|
< 3.0.1
|
3.0.1 |
2014-08-01 |
✓ corregido en la última versión
|
|
CVE-2024-8493
|
The Events Calendar [the-events-calendar] < 6.6.4 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
4,8
|
< 6.6.4
|
6.6.4 |
0000-00-00 |
✓ corregido en la última versión
|
|
CVE-2025-5144
|
The Events Calendar [the-events-calendar] < 6.13.2.1 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
5,4
|
< 6.13.2.1
|
6.13.2.1 |
0000-00-00 |
✓ corregido en la última versión
|
|
CVE-2026-3585
|
The Events Calendar [the-events-calendar] < 6.15.17.1 |
— |
Desconocido
|
< 6.15.17.1
|
6.15.17.1 |
0000-00-00 |
✓ corregido en la última versión
|
|
CVE-2026-2694
|
The Events Calendar [the-events-calendar] < 6.15.16.1 |
— |
Desconocido
|
< 6.15.16.1
|
6.15.16.1 |
0000-00-00 |
✓ corregido en la última versión
|
|
—
|
The Events Calendar [the-events-calendar] < 6.15.1.1 |
— |
Alta
7,5
|
< 6.15.1.1
|
6.15.1.1 |
0000-00-00 |
✓ corregido en la última versión
|
|
—
|
The Events Calendar [the-events-calendar] < 6.15.3 |
— |
Media
5,3
|
< 6.15.3
|
6.15.3 |
0000-00-00 |
✓ corregido en la última versión
|
|
—
|
The Events Calendar [the-events-calendar] < 5.14.0.4 |
— |
Desconocido
|
< 5.14.0.4
|
5.14.0.4 |
— |
✓ corregido en la última versión
|
|
—
|
The Events Calendar [the-events-calendar] < 4.1.1.1 |
— |
Desconocido
|
< 4.1.1.1
|
4.1.1.1 |
— |
✓ corregido en la última versión
|
|
—
|
The Events Calendar [the-events-calendar] < 3.0.1 |
— |
Desconocido
|
< 3.0.1
|
3.0.1 |
— |
✓ corregido en la última versión
|
|
—
|
The Events Calendar [the-events-calendar] < 5.14.0 |
— |
Desconocido
|
< 5.14.0
|
5.14.0 |
— |
✓ corregido en la última versión
|
CVE-2025-24537
The The Events Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.7.0. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an unknown action granted they can trick a site administrator into performing an action such as clicking on a link. The impact of this vulnerability is unknown.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2024-5333
The The Events Calendar plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.8.2 via the /wp-json/tribe/events/v1/events/ REST API due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected events that they should not have access to.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2024-8275
The The Events Calendar plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tribe_has_next_event' function in all versions up to, and including, 6.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Only sites that have manually added tribe_has_next_event() will be vulnerable to this SQL injection.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2024-6931
The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via RSVP name field in all versions up to, and including, 6.6.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2024-37518
The The Events Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.5.1.4. This is due to missing or incorrect nonce validation on the action_restore_events() function. This makes it possible for unauthenticated attackers to restore events via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2024-1295
Multiple plugins and/or themes for WordPress are vulnerable to unauthorized access of data due to a insufficient capability checks and restrictions on a function in various versions. This makes it possible for authenticated attackers, with Contributor-level access and above, to access arbitrary events that they should not have access to.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2024-4180
The The Events Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'view_data' parameter in all versions up to, and including, 6.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2024-31433
Update the WordPress The Events Calendar plugin to the latest available version (at least 6.3.1).
Dhabaleshwar Das discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress The Events Calendar Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. This vulnerability has been fixed in version 6.3.1.
This vulnerability was reported to and published by Patchstack. Our users receive alerts and protections up to 48 hours in advance.
Have additional information or questions about this entry? Get in touch.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2023-6557
The The Events Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.2.8.2 via the route function hooked into wp_ajax_nopriv_tribe_dropdown. This makes it possible for unauthenticated attackers to extract potentially sensitive data including post titles and IDs of pending, private and draft posts.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2023-6203
The Events Calendar WordPress plugin before 6.2.8.1 discloses the content of password protected posts to unauthenticated users via a crafted request
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
The Events Calendar [the-events-calendar] < 6.2.8.1
Update the WordPress Event Single Page Templates Addon For The Events Calendar plugin to the latest available version (at least 6.2.8.1).
Unknown discovered and reported this Sensitive Data Exposure vulnerability in WordPress The Events Calendar Plugin. This vulnerability has been fixed in version 6.2.8.1.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
The Events Calendar [the-events-calendar] < 6.2.8.1
The The Events Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 6.2.8 via the get_data function. This makes it possible for unauthenticated attackers to extract sensitive data including private post content, via the REST API.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
The Events Calendar [the-events-calendar] < 3.0.1
Update the plugin.
An unknown person discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress The Events Calendar Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 3.0.1.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2023-35777
The The Events Calendar plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_ical_output_for_an_event() function in versions up to, and including, 6.1.2.2. This makes it possible for unauthenticated attackers to view arbitrary/private event content.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2023-33999
Update the WordPress The Events Calendar plugin to the latest available version.
Rafie Muhammad (Patchstack) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress The Events Calendar Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 6.1.0.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
The Events Calendar [the-events-calendar] < 4.1.1.1
Update the plugin.
Paul Mynarsky discovered and reported this Open Redirection vulnerability in WordPress The Events Calendar Plugin. This could allow a malicious actor to redirect users from one site to the other due to the redirect URL not being validated. Users could be tricked to visiting a legitimate site to then be redirected to a malicious site and cause a phishing incident. This vulnerability has been fixed in version 4.1.1.1.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
The Events Calendar [the-events-calendar] < 5.14.0.4
Update the WordPress The Events Calendar plugin to the latest available version (at least 5.14.0.4).
An unknown person discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress The Events Calendar Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. This vulnerability has been fixed in version 5.14.0.4.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
The Events Calendar [the-events-calendar] < 5.14.0.4
Update the WordPress The Events Calendar plugin to the latest available version (at least 5.14.0.4).
An unknown person discovered and reported this Sensitive Data Exposure vulnerability in WordPress The Events Calendar Plugin. This vulnerability has been fixed in version 5.14.0.4.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
The Events Calendar [the-events-calendar] < 5.14.0.4
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
The Events Calendar [the-events-calendar] < 5.14.0.4
Sensitive Information Disclosure vulnerability discovered in WordPress The Events Calendar plugin (versions < 5.14.0.4).
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
The Events Calendar [the-events-calendar] < 5.14.0.4
Sensitive Information Disclosure vulnerability discovered in WordPress The Events Calendar plugin (versions < 5.14.0.4).
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2019-15109
The the-events-calendar plugin before 4.8.2 for WordPress has XSS via the tribe_paged URL parameter.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
The Events Calendar [the-events-calendar] < 4.1.1.1
This plugin is prone to an open redirection vulnerability in the "tribe-bar-view" parameter.
Update the plugin.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
The Events Calendar [the-events-calendar] < 4.1.1.1
The Events Calendar plugin for WordPress is vulnerable to an open redirect vulnerability in versions before 4.1.1.1. This allows attackers to redirect victims to an untrusted site via a crafted link on a vulnerable trusted site.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
The Events Calendar [the-events-calendar] < 3.0.1
Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code.
Update the plugin.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2024-8493
The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 6.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2025-5144
The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-date-*’ parameters in all versions up to, and including, 6.13.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2026-3585
The The Events Calendar plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 6.15.17 via the 'ajax_create_import' function. This makes it possible for authenticated attackers, with Author-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2026-2694
The The Events Calendar plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to an improper capability check on the 'can_edit' and 'can_delete' function in all versions up to, and including, 6.15.16. This makes it possible for authenticated attackers, with Contributor-level access and above, to update or trash events, organizers and venues via REST API.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
The Events Calendar [the-events-calendar] < 6.15.1.1
The The Events Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the ‘s’ parameter in all versions up to, and including, 6.15.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
The Events Calendar [the-events-calendar] < 6.15.3
The The Events Calendar plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.15.2 via the REST endpoint. This makes it possible for unauthenticated attackers to extract information about password-protected vendors or venues.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
The Events Calendar [the-events-calendar] < 5.14.0.4
The plugins and themes use an insecure version of the Freemius Framework, which is lacking CSRF and/or authorisation in some of its AJAX actions. As a result, any authenticated users, such as subscriber could access the debug logs. Unauthenticated attackers could also make a logged in admin toggle the debug mode via a CSRF attack.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
The Events Calendar [the-events-calendar] < 4.1.1.1
The problem is located in the "tribe-bar-view" parameter that can be used to
redirect a user to an arbitrary website.
Timeline
* 2016-04-04 : Initial contact with Modern Tribe
* 2016-04-05 : Modern Tribe confirms the report
* 2016-04-07 : Modern Tribe publishes a new version (4.1.1.1) that resolves the issue
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
The Events Calendar [the-events-calendar] < 3.0.1
The The Events Calendar WordPress plugin was affected by a Reflected Cross-Site Scripting (XSS) security vulnerability.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
The Events Calendar [the-events-calendar] < 5.14.0
The plugin does not escape an aggregator URL before outputting it back in an attribute, leading to Reflected Cross-Site Scripting
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
Mantén The Events Calendar actualizado — 6.17.0 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").
Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.