CVE-2026-84740: The Events Calendar 6.12.0 - 6.17.5 - Unauthenticated Arbitrary Shortcode Execution via 'view_data' Parameter
Published Oct 2, 2026
·Updated
The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an unauthenticated AJAX action before merging it into its rendering context, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.
Affected Software
1 affected component
The Events Calendar The Events Calendar>=6.12.0<=6.17.5
Event History
Oct 2, 2026
CVE Published
via MITRE·06:56 AM
Data Sourced
via MITRE·06:56 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which installations are affected?
The issue affects The Events Calendar versions before 6.17.5.1. Versions 6.12.0 through 6.17.5 are identified as vulnerable.
2
Does exploitation require a WordPress account or user interaction?
No. The vulnerable AJAX action is unauthenticated, so an attacker does not need a WordPress account, privileges, or user interaction.
3
What can an attacker do through this issue?
An attacker can supply data through the view_data parameter that is merged into the plugin's rendering context, enabling execution of arbitrary shortcodes registered on the site.