# The Events Calendar <= 6.18.3 - Unauthenticated Arbitrary Shortcode Execution via Search Keyword

- **ID:** WPSEC-2026-2672
- **Plugin:** The Events Calendar (`the-events-calendar`), https://wordpress.org/plugins/the-events-calendar/
- **Affected versions:** from 5.11.0 before 6.18.3.1
- **Fixed in:** 6.18.3.1 (Update to 6.18.3.1 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-94
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-11-06)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/the-events-calendar
- **Fix released:** 2026-11-05
- **Published:** 2026-11-06
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2672/

## Description

The The Events Calendar plugin for WordPress is vulnerable to arbitrary shortcode execution via the calendar search keyword in versions 5.11.0 up to, and including, 6.18.3, due to the plugin running do_shortcode() over the rendered calendar view HTML when the default Page template is used. That HTML contains request values such as the search keyword, which is only HTML-escaped, so its square brackets stay intact. The Archive Events block has the same issue when it is placed in post content, because it renders before WordPress processes shortcodes. This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes by putting shortcode syntax in a calendar search.

## References

- https://wpsec.com/vuln/WPSEC-2026-2672/
- https://plugins.svn.wordpress.org/the-events-calendar/tags/6.18.3.1/
- https://wordpress.org/plugins/the-events-calendar/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2672/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.