CVE-2025-9808

MEDIUM NUCLEI

The Events Calendar <6.15.2 - Info Disclosure

Title source: llm

Exploitation Summary

CVE-2025-9808 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

The The Events Calendar plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.15.2 via the REST endpoint. This makes it possible for unauthenticated attackers to extract information about password-protected vendors or venues.

Nuclei Templates (1)

The Events Calendar <= 6.15.2 - Information Disclosure

MEDIUMVERIFIEDby zer0p0int

Shodan: http.html:"/wp-content/plugins/the-events-calendar/"

FOFA: body="/wp-content/plugins/the-events-calendar/"

References (2)

Core 2

Core References

Product

https://plugins.trac.wordpress.org/changeset/3359403/

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/0f2968d6-f1b1-4cd5-b76b-9dc0f6dd1a6a?source=cve

Scores

CVSS v3 5.3

EPSS 0.0115

EPSS Percentile 79.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-200

Status published

Products (2)

stellarwp/The Events Calendar < 6.15.2

theeventscalendar/The Events Calendar < 6.15.2

Published Sep 16, 2025

Tracked Since Feb 18, 2026