CVE-2025-9808

MEDIUM NUCLEI

The Events Calendar <6.15.2 - Info Disclosure

Title source: llm

Description

The The Events Calendar plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.15.2 via the REST endpoint. This makes it possible for unauthenticated attackers to extract information about password-protected vendors or venues.

Nuclei Templates (1)

The Events Calendar <= 6.15.2 - Information Disclosure

MEDIUMVERIFIEDby zer0p0int

Shodan: http.html:"/wp-content/plugins/the-events-calendar/"

FOFA: body="/wp-content/plugins/the-events-calendar/"

References (2)

[Product] https://plugins.trac.wordpress.org/changeset/3359403/

[Third Party Advisory] https://www.wordfence.com/threat-intel/vulnerabilities/id/0f2968d6-f1b1-4cd5-b76b-9dc0f6dd1a6a?source=cve

Scores

CVSS v3 5.3

EPSS 0.0115

EPSS Percentile 78.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Details

CWE

CWE-200

Status published

Products (2)

stellarwp/The Events Calendar < 6.15.2

theeventscalendar/The Events Calendar < 6.15.2

Published Sep 16, 2025

Tracked Since Feb 18, 2026