{
 "id": "WPSEC-2026-2672",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2672/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2672/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2672/index.md",
 "title": "The Events Calendar <= 6.18.3 - Unauthenticated Arbitrary Shortcode Execution via Search Keyword",
 "description": "The The Events Calendar plugin for WordPress is vulnerable to arbitrary shortcode execution via the calendar search keyword in versions 5.11.0 up to, and including, 6.18.3, due to the plugin running do_shortcode() over the rendered calendar view HTML when the default Page template is used. That HTML contains request values such as the search keyword, which is only HTML-escaped, so its square brackets stay intact. The Archive Events block has the same issue when it is placed in post content, because it renders before WordPress processes shortcodes. This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes by putting shortcode syntax in a calendar search.",
 "plugin": {
  "slug": "the-events-calendar",
  "name": "The Events Calendar",
  "full_name": "The Events Calendar",
  "wordpress_org": "https://wordpress.org/plugins/the-events-calendar/",
  "advisories_url": "https://wpsec.com/vuln/plugin/the-events-calendar/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/the-events-calendar"
 },
 "type": "UNKNOWN",
 "cwe": [
  "CWE-94"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "5.11.0",
    "from_inclusive": true,
    "to": "6.18.3.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 5.11.0 before 6.18.3.1"
  ]
 },
 "introduced_in": "5.11.0",
 "fixed_in": "6.18.3.1",
 "remediation": "Update to 6.18.3.1 or later.",
 "fix_released": "2026-11-05T14:56:51+00:00",
 "published": "2026-11-06T15:42:23+00:00",
 "updated": "2026-11-06T11:58:58.646870+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2672/",
  "https://plugins.svn.wordpress.org/the-events-calendar/tags/6.18.3.1/",
  "https://wordpress.org/plugins/the-events-calendar/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/the-events-calendar",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-11-06"
 }
}