stellarwp Vulnerabilities and Affected Products
Vulnerabilities associated with the_events_calendar.
Products
Clear product- GiveWP – Donation Plugin and Fundraising Platform31 vulnerabilities
- Kadence Blocks — Page Builder Toolkit for Gutenberg Editor29 vulnerabilities
- The Events Calendar19 vulnerabilities
- GiveWP10 vulnerabilities
- Membership Plugin – Restrict Content7 vulnerabilities
- Event Tickets and Registration6 vulnerabilities
- LearnDash LMS5 vulnerabilities
- Bookit — Booking & Appointment Calendar3 vulnerabilities
- Event Tickets3 vulnerabilities
- Gutenberg Blocks by Kadence Blocks3 vulnerabilities
- Kadence WooCommerce Email Designer3 vulnerabilities
- WPComplete3 vulnerabilities
- Restrict Content2 vulnerabilities
- Give – Divi Donation Modules1 vulnerability
- Image Widget1 vulnerability
- iThemes Sync1 vulnerability
- LearnDash LMS – Reports1 vulnerability
- Membership Plugin – Kadence Memberships1 vulnerability
- the_events_calendar1 vulnerability
- Virtue1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2025-9807HIGH | The Events Calendar <= 6.15.1 - Unauthenticated SQL InjectionThe The Events Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the ‘s’ parameter in all versions up to, and including, 6.15.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CWE-89Sep 12, 2025 | CVSS7.5v3.1 | EPSS0.347% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |