CVE-2025-12197: The Events Calendar 6.15.1.1 - 6.15.9 - Unauthenticated SQL Injection via s
The The Events Calendar plugin for WordPress is vulnerable to blind SQL Injection via the 's' parameter in versions 6.15.1.1 to 6.15.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12197?
CVE-2025-12197 is considered a high severity vulnerability due to its potential for SQL injection attacks.
How do I fix CVE-2025-12197?
To fix CVE-2025-12197, update the The Events Calendar plugin to a version newer than 6.15.9.
Which versions of The Events Calendar are affected by CVE-2025-12197?
CVE-2025-12197 affects The Events Calendar versions from 6.15.1.1 to 6.15.9.
What attack vectors does CVE-2025-12197 expose?
CVE-2025-12197 exposes the site to blind SQL injection attacks via the 's' parameter.
Can CVE-2025-12197 be exploited remotely?
Yes, CVE-2025-12197 can be exploited remotely by attackers who send crafted requests.