medium6.5
CVE-2026-84740
The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an unauthenticated AJAX action before merging it into its …
Impact
The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an unauthenticated AJAX action before merging it into its rendering context, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.
Affected products
| Product | Affected versions |
|---|---|
| Events Calendar WordPress Plugin | before 6.17.5.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.