The Events Calendar <= 6.18.3 - Unauthenticated Arbitrary Shortcode Execution via Search Keyword
- ID
- WPSEC-2026-2672
- Plugin
- The Events Calendar (the-events-calendar)
- Affected
- from 5.11.0 before 6.18.3.1
- Remediation
- Update to 6.18.3.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-94
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-11-06
- Attack surface
- The Events Calendar on WPSec AttackSurface
- Fix released
- Published
Description
The The Events Calendar plugin for WordPress is vulnerable to arbitrary shortcode execution via the calendar search keyword in versions 5.11.0 up to, and including, 6.18.3, due to the plugin running do_shortcode() over the rendered calendar view HTML when the default Page template is used. That HTML contains request values such as the search keyword, which is only HTML-escaped, so its square brackets stay intact. The Archive Events block has the same issue when it is placed in post content, because it renders before WordPress processes shortcodes. This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes by putting shortcode syntax in a calendar search.
References
- https://wpsec.com/vuln/WPSEC-2026-2672/
- https://plugins.svn.wordpress.org/the-events-calendar/tags/6.18.3.1/
- https://wordpress.org/plugins/the-events-calendar/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS