CVE-2026-84740
Received Received - Intake

Arbitrary Shortcode Execution in The Events Calendar WordPress Plugin

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: WPScan

Description
The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an unauthenticated AJAX action before merging it into its rendering context, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-02
AI Q&A
2026-10-02
EPSS Evaluated
N/A
NVD
CVE-2026-84740
EUVD
EUVD-2026-91210

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
moderntribe the_events_calendar to 6.17.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects The Events Calendar WordPress plugin versions 6.12.0 to 6.17.5. It allows unauthenticated users to execute arbitrary shortcodes by exploiting insufficient validation and sanitization of the 'view_data' parameter in an unauthenticated AJAX action. This can lead to unauthorized actions or data exposure on the site.

Detection Guidance

Check the installed version of The Events Calendar plugin using WordPress admin panel or via command line: wp plugin list --name='the-events-calendar'. If the version is between 6.12.0 and 6.17.5, the system is vulnerable.

Impact Analysis

An attacker could exploit this to run malicious shortcodes, potentially stealing sensitive data, defacing the website, or performing unauthorized actions. Since no authentication is required, any visitor to the site could trigger this issue.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR (data protection) and HIPAA (health data privacy) requirements. Organizations may face legal penalties or reputational damage if exploited.

Mitigation Strategies

Update The Events Calendar plugin to version 6.17.5.1 or later immediately. Disable the plugin temporarily if an update is not immediately available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84740. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart