CVE-2026-84740
Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: WPScan

Description
The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an unauthenticated AJAX action before merging it into its rendering context, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-19
AI Q&A
2026-10-02
EPSS Evaluated
2026-10-18
NVD
CVE-2026-84740
EUVD
EUVD-2026-91210

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown The Events Calendar 6.12.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects The Events Calendar WordPress plugin versions 6.12.0 to 6.17.5. It allows unauthenticated users to execute arbitrary shortcodes by exploiting insufficient validation and sanitization of the 'view_data' parameter in an unauthenticated AJAX action. This can lead to unauthorized actions or data exposure on the site.

Detection Guidance

Check the installed version of The Events Calendar plugin using WordPress admin panel or via command line: wp plugin list --name='the-events-calendar'. If the version is between 6.12.0 and 6.17.5, the system is vulnerable.

Impact Analysis

An attacker could exploit this to run malicious shortcodes, potentially stealing sensitive data, defacing the website, or performing unauthorized actions. Since no authentication is required, any visitor to the site could trigger this issue.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR (data protection) and HIPAA (health data privacy) requirements. Organizations may face legal penalties or reputational damage if exploited.

Mitigation Strategies

Update The Events Calendar plugin to version 6.17.5.1 or later immediately. Disable the plugin temporarily if an update is not immediately available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84740. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart