Missing Authorization in The Events Calendar QR Code Modal

Skrevet den af i The Events Calendar

The QR code modal handler ran without a nonce check or a per-post capability check, so a subscriber could read and alter QR code data for events they cannot edit, including drafts. It now verifies the request nonce and requires edit_post on the target event.

This vulnerability affects the following application versions:

  • The Events Calendar 6.13.0
  • The Events Calendar 6.13.1
  • The Events Calendar 6.13.2.1
  • The Events Calendar 6.14.0
  • The Events Calendar 6.14.1
  • The Events Calendar 6.14.2
  • The Events Calendar 6.15.0
  • The Events Calendar 6.15.0.1
  • The Events Calendar 6.15.1
  • The Events Calendar 6.15.1.1
  • The Events Calendar 6.15.2
  • The Events Calendar 6.15.3
  • The Events Calendar 6.15.4
  • The Events Calendar 6.15.5
  • The Events Calendar 6.15.6
  • The Events Calendar 6.15.7
  • The Events Calendar 6.15.8
  • The Events Calendar 6.15.9

Missing Capability Check in The Events Calendar System Information Opt-in

Skrevet den af i The Events Calendar

The system information opt-in handler verified a nonce but never checked the caller’s capability, so any logged-in user who could obtain the nonce could toggle the setting. The handler now also requires manage_options.

This vulnerability affects the following application versions:

  • The Events Calendar 4.6.10
  • The Events Calendar 4.6.10.2
  • The Events Calendar 4.6.11
  • The Events Calendar 4.6.11.2
  • The Events Calendar 4.6.12.1
  • The Events Calendar 4.6.13.1
  • The Events Calendar 4.6.14
  • The Events Calendar 4.6.14.2
  • The Events Calendar 4.6.15.1
  • The Events Calendar 4.6.16.1
  • The Events Calendar 4.6.17.1
  • The Events Calendar 4.6.18.1
  • The Events Calendar 4.6.19.1
  • The Events Calendar 4.6.20
  • The Events Calendar 4.6.20.2
  • The Events Calendar 4.6.21.1
  • The Events Calendar 4.6.22
  • The Events Calendar 4.6.22.2
  • The Events Calendar 4.6.23.1
  • The Events Calendar 4.6.24
  • The Events Calendar 4.6.24.2
  • The Events Calendar 4.6.25.1
  • The Events Calendar 4.6.26
  • The Events Calendar 4.6.26.2
  • The Events Calendar 4.7
  • The Events Calendar 4.7.0.2
  • The Events Calendar 4.7.1.1
  • The Events Calendar 4.7.2.1
  • The Events Calendar 4.7.3.1
  • The Events Calendar 4.7.4.1
  • The Events Calendar 4.8
  • The Events Calendar 4.8.0.2
  • The Events Calendar 4.8.1.1
  • The Events Calendar 4.8.2.1
  • The Events Calendar 4.9.0.1
  • The Events Calendar 4.9.0.2
  • The Events Calendar 4.9.0.4
  • The Events Calendar 4.9.1
  • The Events Calendar 4.9.1.2
  • The Events Calendar 4.9.2.1
  • The Events Calendar 4.9.3
  • The Events Calendar 4.9.3.1
  • The Events Calendar 4.9.3.3
  • The Events Calendar 4.9.4.1
  • The Events Calendar 4.9.6.1
  • The Events Calendar 4.9.7.1
  • The Events Calendar 4.9.8.1
  • The Events Calendar 4.9.9.1
  • The Events Calendar 4.9.10.1
  • The Events Calendar 4.9.11.1
  • The Events Calendar 4.9.12.1
  • The Events Calendar 4.9.13.1
  • The Events Calendar 4.9.14.1
  • The Events Calendar 5.0.0
  • The Events Calendar 5.0.0.1
  • The Events Calendar 5.0.0.3
  • The Events Calendar 5.0.1.1
  • The Events Calendar 5.0.1.2
  • The Events Calendar 5.0.2
  • The Events Calendar 5.0.2.2
  • The Events Calendar 5.0.2.3
  • The Events Calendar 5.0.3
  • The Events Calendar 5.0.3.3
  • The Events Calendar 5.1.0.1
  • The Events Calendar 5.1.0.2
  • The Events Calendar 5.1.1.1
  • The Events Calendar 5.1.1.2
  • The Events Calendar 5.1.2.1
  • The Events Calendar 5.1.2.2
  • The Events Calendar 5.1.3
  • The Events Calendar 5.1.3.1
  • The Events Calendar 5.1.4
  • The Events Calendar 5.1.4.1
  • The Events Calendar 5.1.5
  • The Events Calendar 5.1.5.1
  • The Events Calendar 5.1.6
  • The Events Calendar 5.1.6.1
  • The Events Calendar 5.2.0
  • The Events Calendar 5.2.0.1
  • The Events Calendar 5.2.1
  • The Events Calendar 5.2.1.1
  • The Events Calendar 5.2.1.2
  • The Events Calendar 5.3.0
  • The Events Calendar 5.3.0.1
  • The Events Calendar 5.3.1
  • The Events Calendar 5.3.1.1
  • The Events Calendar 5.3.1.2
  • The Events Calendar 5.3.2
  • The Events Calendar 5.3.2.1
  • The Events Calendar 5.3.2.2
  • The Events Calendar 5.4.0
  • The Events Calendar 5.4.0.1
  • The Events Calendar 5.4.0.2
  • The Events Calendar 5.4.0.3
  • The Events Calendar 5.5.0
  • The Events Calendar 5.5.0.1
  • The Events Calendar 5.5.0.2
  • The Events Calendar 5.6.0
  • The Events Calendar 5.7.0
  • The Events Calendar 5.7.1
  • The Events Calendar 5.8.0
  • The Events Calendar 5.8.1
  • The Events Calendar 5.8.2
  • The Events Calendar 5.9.0
  • The Events Calendar 5.9.1
  • The Events Calendar 5.9.2
  • The Events Calendar 5.10.0
  • The Events Calendar 5.10.1
  • The Events Calendar 5.11.0
  • The Events Calendar 5.12.0
  • The Events Calendar 5.12.1
  • The Events Calendar 5.12.2
  • The Events Calendar 5.12.3
  • The Events Calendar 5.12.4
  • The Events Calendar 5.13.0
  • The Events Calendar 5.14.0
  • The Events Calendar 5.14.0.1
  • The Events Calendar 5.14.0.2
  • The Events Calendar 5.14.0.3
  • The Events Calendar 5.14.0.4
  • The Events Calendar 5.14.1
  • The Events Calendar 5.14.2
  • The Events Calendar 5.14.2.1
  • The Events Calendar 5.15.0
  • The Events Calendar 5.15.0.1
  • The Events Calendar 5.16.0
  • The Events Calendar 5.16.1
  • The Events Calendar 5.16.1.1
  • The Events Calendar 5.16.2
  • The Events Calendar 5.16.2.1
  • The Events Calendar 5.16.3
  • The Events Calendar 5.16.3.1
  • The Events Calendar 5.16.4
  • The Events Calendar 5.16.4.1
  • The Events Calendar 6.0.0
  • The Events Calendar 6.0.0.1
  • The Events Calendar 6.0.1
  • The Events Calendar 6.0.1.1
  • The Events Calendar 6.0.2
  • The Events Calendar 6.0.3
  • The Events Calendar 6.0.3.1
  • The Events Calendar 6.0.4
  • The Events Calendar 6.0.5
  • The Events Calendar 6.0.6
  • The Events Calendar 6.0.6.1
  • The Events Calendar 6.0.6.2
  • The Events Calendar 6.0.7
  • The Events Calendar 6.0.7.1
  • The Events Calendar 6.0.8
  • The Events Calendar 6.0.9
  • The Events Calendar 6.0.10
  • The Events Calendar 6.0.11
  • The Events Calendar 6.0.12
  • The Events Calendar 6.0.13
  • The Events Calendar 6.0.13.1
  • The Events Calendar 6.1.0
  • The Events Calendar 6.1.0.1
  • The Events Calendar 6.1.0.2
  • The Events Calendar 6.1.1
  • The Events Calendar 6.1.2
  • The Events Calendar 6.1.2.1
  • The Events Calendar 6.1.2.2
  • The Events Calendar 6.1.3
  • The Events Calendar 6.1.4
  • The Events Calendar 6.2.0
  • The Events Calendar 6.2.0.1
  • The Events Calendar 6.2.1
  • The Events Calendar 6.2.2
  • The Events Calendar 6.2.2.1
  • The Events Calendar 6.2.3
  • The Events Calendar 6.2.3.1
  • The Events Calendar 6.2.3.2
  • The Events Calendar 6.2.4
  • The Events Calendar 6.2.5
  • The Events Calendar 6.2.6
  • The Events Calendar 6.2.6.1
  • The Events Calendar 6.2.7
  • The Events Calendar 6.2.8
  • The Events Calendar 6.2.8.1
  • The Events Calendar 6.2.8.2
  • The Events Calendar 6.2.9
  • The Events Calendar 6.3.0
  • The Events Calendar 6.3.1
  • The Events Calendar 6.3.2
  • The Events Calendar 6.3.3
  • The Events Calendar 6.3.3.1
  • The Events Calendar 6.3.4
  • The Events Calendar 6.3.5
  • The Events Calendar 6.3.6
  • The Events Calendar 6.3.7
  • The Events Calendar 6.4.0
  • The Events Calendar 6.4.0.1
  • The Events Calendar 6.5.0
  • The Events Calendar 6.5.0.1
  • The Events Calendar 6.5.1
  • The Events Calendar 6.5.1.1
  • The Events Calendar 6.5.1.2
  • The Events Calendar 6.5.1.3
  • The Events Calendar 6.5.1.4
  • The Events Calendar 6.5.1.5
  • The Events Calendar 6.5.1.6
  • The Events Calendar 6.5.2
  • The Events Calendar 6.6.0
  • The Events Calendar 6.6.0.1
  • The Events Calendar 6.6.0.2
  • The Events Calendar 6.6.1
  • The Events Calendar 6.6.2
  • The Events Calendar 6.6.3
  • The Events Calendar 6.6.4
  • The Events Calendar 6.6.4.1
  • The Events Calendar 6.6.4.2
  • The Events Calendar 6.7.0
  • The Events Calendar 6.7.1
  • The Events Calendar 6.8.0
  • The Events Calendar 6.8.1
  • The Events Calendar 6.8.2
  • The Events Calendar 6.8.2.1
  • The Events Calendar 6.8.3
  • The Events Calendar 6.9.0
  • The Events Calendar 6.9.1
  • The Events Calendar 6.10.0
  • The Events Calendar 6.10.1
  • The Events Calendar 6.10.1.1
  • The Events Calendar 6.10.2
  • The Events Calendar 6.10.3
  • The Events Calendar 6.11.0
  • The Events Calendar 6.11.0.1
  • The Events Calendar 6.11.1
  • The Events Calendar 6.11.2
  • The Events Calendar 6.11.2.1
  • The Events Calendar 6.13.0
  • The Events Calendar 6.13.1
  • The Events Calendar 6.13.2.1
  • The Events Calendar 6.14.0
  • The Events Calendar 6.14.1
  • The Events Calendar 6.14.2
  • The Events Calendar 6.15.0
  • The Events Calendar 6.15.0.1
  • The Events Calendar 6.15.1
  • The Events Calendar 6.15.1.1
  • The Events Calendar 6.15.2
  • The Events Calendar 6.15.3
  • The Events Calendar 6.15.4
  • The Events Calendar 6.15.5
  • The Events Calendar 6.15.6
  • The Events Calendar 6.15.7
  • The Events Calendar 6.15.8
  • The Events Calendar 6.15.9
  • The Events Calendar 6.15.10
  • The Events Calendar 6.15.11
  • The Events Calendar 6.15.12
  • The Events Calendar 6.15.12.1
  • The Events Calendar 6.15.12.2

Missing Authorization in The Events Calendar Ignored Events Restore

Skrevet den af i The Events Calendar

The Events Calendar’s Ignored Events restore action did not check that the target event was actually ignored before changing its status. As a result, an authenticated user with Contributor-level access could “restore” their own draft or pending event and get it published without review. Affects versions up to and including 6.18.2; fixed in 6.18.3.

This vulnerability affects the following application versions:

  • The Events Calendar 4.7
  • The Events Calendar 4.7.0.2
  • The Events Calendar 4.7.1.1
  • The Events Calendar 4.7.2.1
  • The Events Calendar 4.7.3.1
  • The Events Calendar 4.7.4.1
  • The Events Calendar 4.8
  • The Events Calendar 4.8.0.2
  • The Events Calendar 4.8.1.1
  • The Events Calendar 4.8.2.1
  • The Events Calendar 4.9.0.1
  • The Events Calendar 4.9.0.2
  • The Events Calendar 4.9.0.4
  • The Events Calendar 4.9.1
  • The Events Calendar 4.9.1.2
  • The Events Calendar 4.9.2.1
  • The Events Calendar 4.9.3
  • The Events Calendar 4.9.3.3
  • The Events Calendar 4.9.4.1
  • The Events Calendar 4.9.6.1
  • The Events Calendar 4.9.7.1
  • The Events Calendar 4.9.8.1
  • The Events Calendar 4.9.9.1
  • The Events Calendar 4.9.10.1
  • The Events Calendar 4.9.11.1
  • The Events Calendar 4.9.12.1
  • The Events Calendar 4.9.13.1
  • The Events Calendar 4.9.14.1
  • The Events Calendar 5.0.0
  • The Events Calendar 5.0.0.1
  • The Events Calendar 5.0.0.3
  • The Events Calendar 5.0.1.1
  • The Events Calendar 5.0.1.2
  • The Events Calendar 5.0.2
  • The Events Calendar 5.0.2.2
  • The Events Calendar 5.0.3.3
  • The Events Calendar 5.1.0.1
  • The Events Calendar 5.1.0.2
  • The Events Calendar 5.1.1.1
  • The Events Calendar 5.1.1.2
  • The Events Calendar 5.1.2.1
  • The Events Calendar 5.1.3
  • The Events Calendar 5.1.3.1
  • The Events Calendar 5.1.4
  • The Events Calendar 5.1.4.1
  • The Events Calendar 5.1.5
  • The Events Calendar 5.1.5.1
  • The Events Calendar 5.1.6
  • The Events Calendar 5.1.6.1
  • The Events Calendar 5.2.0
  • The Events Calendar 5.2.0.1
  • The Events Calendar 5.2.1
  • The Events Calendar 5.2.1.1
  • The Events Calendar 5.2.1.2
  • The Events Calendar 5.3.0
  • The Events Calendar 5.3.0.1
  • The Events Calendar 5.3.1
  • The Events Calendar 5.3.1.1
  • The Events Calendar 5.3.1.2
  • The Events Calendar 5.3.2
  • The Events Calendar 5.3.2.1
  • The Events Calendar 5.3.2.2
  • The Events Calendar 5.4.0
  • The Events Calendar 5.4.0.1
  • The Events Calendar 5.4.0.2
  • The Events Calendar 5.4.0.3
  • The Events Calendar 5.5.0
  • The Events Calendar 5.5.0.1
  • The Events Calendar 5.5.0.2
  • The Events Calendar 5.6.0
  • The Events Calendar 5.7.0
  • The Events Calendar 5.7.1
  • The Events Calendar 5.8.0
  • The Events Calendar 5.8.2
  • The Events Calendar 5.9.0
  • The Events Calendar 5.9.1
  • The Events Calendar 5.9.2
  • The Events Calendar 5.10.0
  • The Events Calendar 5.10.1
  • The Events Calendar 5.11.0
  • The Events Calendar 5.12.0
  • The Events Calendar 5.12.2
  • The Events Calendar 5.12.3
  • The Events Calendar 5.12.4
  • The Events Calendar 5.13.0
  • The Events Calendar 5.14.0
  • The Events Calendar 5.14.0.1
  • The Events Calendar 5.14.0.2
  • The Events Calendar 5.14.0.3
  • The Events Calendar 5.14.0.4
  • The Events Calendar 5.14.1
  • The Events Calendar 5.14.2
  • The Events Calendar 5.14.2.1
  • The Events Calendar 5.15.0
  • The Events Calendar 5.15.0.1
  • The Events Calendar 5.16.0
  • The Events Calendar 5.16.1
  • The Events Calendar 5.16.1.1
  • The Events Calendar 5.16.2
  • The Events Calendar 5.16.2.1
  • The Events Calendar 5.16.3
  • The Events Calendar 5.16.3.1
  • The Events Calendar 5.16.4
  • The Events Calendar 5.16.4.1
  • The Events Calendar 6.0.0
  • The Events Calendar 6.0.0.1
  • The Events Calendar 6.0.1
  • The Events Calendar 6.0.1.1
  • The Events Calendar 6.0.2
  • The Events Calendar 6.0.3
  • The Events Calendar 6.0.3.1
  • The Events Calendar 6.0.4
  • The Events Calendar 6.0.5
  • The Events Calendar 6.0.6
  • The Events Calendar 6.0.6.1
  • The Events Calendar 6.0.6.2
  • The Events Calendar 6.0.7
  • The Events Calendar 6.0.7.1
  • The Events Calendar 6.0.8
  • The Events Calendar 6.0.9
  • The Events Calendar 6.0.10
  • The Events Calendar 6.0.11
  • The Events Calendar 6.0.12
  • The Events Calendar 6.0.13
  • The Events Calendar 6.0.13.1
  • The Events Calendar 6.1.0
  • The Events Calendar 6.1.0.1
  • The Events Calendar 6.1.0.2
  • The Events Calendar 6.1.1
  • The Events Calendar 6.1.2
  • The Events Calendar 6.1.2.1
  • The Events Calendar 6.1.2.2
  • The Events Calendar 6.1.3
  • The Events Calendar 6.1.4
  • The Events Calendar 6.2.0
  • The Events Calendar 6.2.0.1
  • The Events Calendar 6.2.1
  • The Events Calendar 6.2.2
  • The Events Calendar 6.2.2.1
  • The Events Calendar 6.2.3
  • The Events Calendar 6.2.3.1
  • The Events Calendar 6.2.3.2
  • The Events Calendar 6.2.4
  • The Events Calendar 6.2.5
  • The Events Calendar 6.2.6
  • The Events Calendar 6.2.6.1
  • The Events Calendar 6.2.7
  • The Events Calendar 6.2.8
  • The Events Calendar 6.2.8.1
  • The Events Calendar 6.2.8.2
  • The Events Calendar 6.3.0
  • The Events Calendar 6.3.1
  • The Events Calendar 6.3.3
  • The Events Calendar 6.3.3.1
  • The Events Calendar 6.3.4
  • The Events Calendar 6.3.5
  • The Events Calendar 6.3.6
  • The Events Calendar 6.3.7
  • The Events Calendar 6.4.0
  • The Events Calendar 6.4.0.1
  • The Events Calendar 6.5.0
  • The Events Calendar 6.5.0.1
  • The Events Calendar 6.5.1
  • The Events Calendar 6.5.1.1
  • The Events Calendar 6.5.1.2
  • The Events Calendar 6.5.1.3
  • The Events Calendar 6.5.1.4
  • The Events Calendar 6.5.1.5
  • The Events Calendar 6.5.1.6
  • The Events Calendar 6.5.2
  • The Events Calendar 6.6.0
  • The Events Calendar 6.6.0.1
  • The Events Calendar 6.6.0.2
  • The Events Calendar 6.6.1
  • The Events Calendar 6.6.2
  • The Events Calendar 6.6.3
  • The Events Calendar 6.6.4
  • The Events Calendar 6.6.4.1
  • The Events Calendar 6.6.4.2
  • The Events Calendar 6.7.0
  • The Events Calendar 6.7.1
  • The Events Calendar 6.8.0
  • The Events Calendar 6.8.1
  • The Events Calendar 6.8.2
  • The Events Calendar 6.8.2.1
  • The Events Calendar 6.9.0
  • The Events Calendar 6.9.1
  • The Events Calendar 6.10.0
  • The Events Calendar 6.10.1
  • The Events Calendar 6.10.3
  • The Events Calendar 6.11.0.1
  • The Events Calendar 6.11.1
  • The Events Calendar 6.11.2
  • The Events Calendar 6.11.2.1
  • The Events Calendar 6.13.0
  • The Events Calendar 6.13.1
  • The Events Calendar 6.13.2.1
  • The Events Calendar 6.14.0
  • The Events Calendar 6.14.1
  • The Events Calendar 6.14.2
  • The Events Calendar 6.15.0
  • The Events Calendar 6.15.0.1
  • The Events Calendar 6.15.1
  • The Events Calendar 6.15.1.1
  • The Events Calendar 6.15.2
  • The Events Calendar 6.15.3
  • The Events Calendar 6.15.4
  • The Events Calendar 6.15.5
  • The Events Calendar 6.15.6
  • The Events Calendar 6.15.8
  • The Events Calendar 6.15.9
  • The Events Calendar 6.15.10
  • The Events Calendar 6.15.12
  • The Events Calendar 6.15.12.1
  • The Events Calendar 6.15.12.2
  • The Events Calendar 6.15.13
  • The Events Calendar 6.15.13.1
  • The Events Calendar 6.15.14
  • The Events Calendar 6.15.15
  • The Events Calendar 6.15.16
  • The Events Calendar 6.15.17.1
  • The Events Calendar 6.15.18
  • The Events Calendar 6.15.19
  • The Events Calendar 6.15.20
  • The Events Calendar 6.16.0
  • The Events Calendar 6.16.1
  • The Events Calendar 6.16.2
  • The Events Calendar 6.16.3
  • The Events Calendar 6.16.4
  • The Events Calendar 6.16.4.1
  • The Events Calendar 6.16.5
  • The Events Calendar 6.16.5.1
  • The Events Calendar 6.17.0
  • The Events Calendar 6.17.1
  • The Events Calendar 6.17.2
  • The Events Calendar 6.17.3
  • The Events Calendar 6.17.3.1
  • The Events Calendar 6.17.4
  • The Events Calendar 6.17.4.1
  • The Events Calendar 6.17.5
  • The Events Calendar 6.17.5.1
  • The Events Calendar 6.18.0
  • The Events Calendar 6.18.1
  • The Events Calendar 6.18.2

Unauthenticated SQL Injection in The Events Calendar Custom Tables Query

Skrevet den af i The Events Calendar

The Events Calendar up to and including 6.15.1 redirects the ORDER BY clause of event queries through Custom_Tables_Query::parse_orderby(), but falls back to the raw, unvalidated ORDER BY fragment whenever the field is not recognised. An unauthenticated visitor can therefore smuggle arbitrary SQL into the ORDER BY clause of a public events query (reachable via the search parameter) and extract database contents through a time-based blind injection.

This vulnerability affects the following application versions:

  • The Events Calendar 6.0.4
  • The Events Calendar 6.0.5
  • The Events Calendar 6.0.6
  • The Events Calendar 6.0.6.1
  • The Events Calendar 6.0.6.2
  • The Events Calendar 6.0.7
  • The Events Calendar 6.0.7.1
  • The Events Calendar 6.0.8
  • The Events Calendar 6.0.9
  • The Events Calendar 6.0.10
  • The Events Calendar 6.0.11
  • The Events Calendar 6.0.12
  • The Events Calendar 6.0.13
  • The Events Calendar 6.0.13.1
  • The Events Calendar 6.1.0
  • The Events Calendar 6.1.0.1
  • The Events Calendar 6.1.0.2
  • The Events Calendar 6.1.1
  • The Events Calendar 6.1.2
  • The Events Calendar 6.1.2.1
  • The Events Calendar 6.1.2.2
  • The Events Calendar 6.1.3
  • The Events Calendar 6.1.4
  • The Events Calendar 6.2.0
  • The Events Calendar 6.2.0.1
  • The Events Calendar 6.2.1
  • The Events Calendar 6.2.2
  • The Events Calendar 6.2.2.1
  • The Events Calendar 6.2.3
  • The Events Calendar 6.2.3.1
  • The Events Calendar 6.2.3.2
  • The Events Calendar 6.2.4
  • The Events Calendar 6.2.5
  • The Events Calendar 6.2.6
  • The Events Calendar 6.2.6.1
  • The Events Calendar 6.2.7
  • The Events Calendar 6.2.8
  • The Events Calendar 6.2.8.1
  • The Events Calendar 6.2.8.2
  • The Events Calendar 6.3.0
  • The Events Calendar 6.3.1
  • The Events Calendar 6.3.3
  • The Events Calendar 6.3.3.1
  • The Events Calendar 6.3.4
  • The Events Calendar 6.3.5
  • The Events Calendar 6.3.6
  • The Events Calendar 6.3.7
  • The Events Calendar 6.4.0
  • The Events Calendar 6.4.0.1
  • The Events Calendar 6.5.0
  • The Events Calendar 6.5.0.1
  • The Events Calendar 6.5.1
  • The Events Calendar 6.5.1.1
  • The Events Calendar 6.5.1.2
  • The Events Calendar 6.5.1.3
  • The Events Calendar 6.5.1.4
  • The Events Calendar 6.5.1.5
  • The Events Calendar 6.5.1.6
  • The Events Calendar 6.5.2
  • The Events Calendar 6.6.0
  • The Events Calendar 6.6.0.1
  • The Events Calendar 6.6.0.2
  • The Events Calendar 6.6.1
  • The Events Calendar 6.6.2
  • The Events Calendar 6.6.3
  • The Events Calendar 6.6.4
  • The Events Calendar 6.6.4.1
  • The Events Calendar 6.6.4.2
  • The Events Calendar 6.7.0
  • The Events Calendar 6.7.1
  • The Events Calendar 6.8.0
  • The Events Calendar 6.8.1
  • The Events Calendar 6.8.2
  • The Events Calendar 6.8.2.1
  • The Events Calendar 6.8.3
  • The Events Calendar 6.9.0
  • The Events Calendar 6.9.1
  • The Events Calendar 6.10.0
  • The Events Calendar 6.10.1
  • The Events Calendar 6.10.1.1
  • The Events Calendar 6.10.2
  • The Events Calendar 6.10.3
  • The Events Calendar 6.11.0.1
  • The Events Calendar 6.11.1
  • The Events Calendar 6.11.2
  • The Events Calendar 6.11.2.1
  • The Events Calendar 6.13.0
  • The Events Calendar 6.13.1
  • The Events Calendar 6.13.2.1
  • The Events Calendar 6.14.0
  • The Events Calendar 6.14.1
  • The Events Calendar 6.14.2
  • The Events Calendar 6.15.0
  • The Events Calendar 6.15.0.1
  • The Events Calendar 6.15.1

iCal export header/line-break injection hardening in iCal generator

Skrevet den af i The Events Calendar

The Events Calendar 6.16.4.1 (released June 19, 2026) hardens the iCalendar export feed against header injection and line-break injection. Prior to this fix, the plugin wrote unsanitized values into HTTP response headers and iCal VCALENDAR header fields: the Content-Disposition filename came directly from get_file_name() without sanitization, and the X-WR-CALNAME and X-ORIGINAL-URL fields embedded the unescaped site name/URL (filterable via tribe_ical_feed_calname). An attacker who could influence the site name or the calname filter value could inject CRLF sequences to add arbitrary HTTP headers or spoof iCal fields in the exported .ics file. The fix applies sanitize_file_name() to the Content-Disposition filename, esc_url_raw() to the site URL, and sanitize_text_field() to the calendar name before embedding them in HTTP headers and iCal output. A non-security companion change makes DTSTAMP deterministic (tied to event modified time rather than wall-clock).

This vulnerability affects the following application versions:

  • The Events Calendar 5.0.0
  • The Events Calendar 5.0.0.1
  • The Events Calendar 5.0.0.3
  • The Events Calendar 5.0.1.1
  • The Events Calendar 5.0.1.2
  • The Events Calendar 5.0.2
  • The Events Calendar 5.0.2.2
  • The Events Calendar 5.0.3.3
  • The Events Calendar 5.1.0.1
  • The Events Calendar 5.1.0.2
  • The Events Calendar 5.1.1.1
  • The Events Calendar 5.1.1.2
  • The Events Calendar 5.1.2.1
  • The Events Calendar 5.1.3
  • The Events Calendar 5.1.3.1
  • The Events Calendar 5.1.4
  • The Events Calendar 5.1.4.1
  • The Events Calendar 5.1.5
  • The Events Calendar 5.1.5.1
  • The Events Calendar 5.1.6
  • The Events Calendar 5.1.6.1
  • The Events Calendar 5.2.0
  • The Events Calendar 5.2.0.1
  • The Events Calendar 5.2.1
  • The Events Calendar 5.2.1.1
  • The Events Calendar 5.2.1.2
  • The Events Calendar 5.3.0
  • The Events Calendar 5.3.0.1
  • The Events Calendar 5.3.1
  • The Events Calendar 5.3.1.1
  • The Events Calendar 5.3.1.2
  • The Events Calendar 5.3.2
  • The Events Calendar 5.3.2.1
  • The Events Calendar 5.3.2.2
  • The Events Calendar 5.4.0
  • The Events Calendar 5.4.0.1
  • The Events Calendar 5.4.0.2
  • The Events Calendar 5.4.0.3
  • The Events Calendar 5.5.0
  • The Events Calendar 5.5.0.1
  • The Events Calendar 5.5.0.2
  • The Events Calendar 5.6.0
  • The Events Calendar 5.7.0
  • The Events Calendar 5.7.1
  • The Events Calendar 5.8.0
  • The Events Calendar 5.8.2
  • The Events Calendar 5.9.0
  • The Events Calendar 5.9.1
  • The Events Calendar 5.9.2
  • The Events Calendar 5.10.0
  • The Events Calendar 5.10.1
  • The Events Calendar 5.11.0
  • The Events Calendar 5.12.0
  • The Events Calendar 5.12.2
  • The Events Calendar 5.12.3
  • The Events Calendar 5.12.4
  • The Events Calendar 5.13.0
  • The Events Calendar 5.14.0
  • The Events Calendar 5.14.0.1
  • The Events Calendar 5.14.0.2
  • The Events Calendar 5.14.0.3
  • The Events Calendar 5.14.0.4
  • The Events Calendar 5.14.1
  • The Events Calendar 5.14.2
  • The Events Calendar 5.14.2.1
  • The Events Calendar 5.15.0
  • The Events Calendar 5.15.0.1
  • The Events Calendar 5.16.0
  • The Events Calendar 5.16.1
  • The Events Calendar 5.16.1.1
  • The Events Calendar 5.16.2
  • The Events Calendar 5.16.2.1
  • The Events Calendar 5.16.3
  • The Events Calendar 5.16.3.1
  • The Events Calendar 5.16.4
  • The Events Calendar 5.16.4.1
  • The Events Calendar 6.0.0
  • The Events Calendar 6.0.0.1
  • The Events Calendar 6.0.1
  • The Events Calendar 6.0.1.1
  • The Events Calendar 6.0.2
  • The Events Calendar 6.0.3
  • The Events Calendar 6.0.3.1
  • The Events Calendar 6.0.4
  • The Events Calendar 6.0.5
  • The Events Calendar 6.0.6
  • The Events Calendar 6.0.6.1
  • The Events Calendar 6.0.6.2
  • The Events Calendar 6.0.7
  • The Events Calendar 6.0.7.1
  • The Events Calendar 6.0.8
  • The Events Calendar 6.0.9
  • The Events Calendar 6.0.10
  • The Events Calendar 6.0.11
  • The Events Calendar 6.0.12
  • The Events Calendar 6.0.13
  • The Events Calendar 6.0.13.1
  • The Events Calendar 6.1.0
  • The Events Calendar 6.1.0.1
  • The Events Calendar 6.1.0.2
  • The Events Calendar 6.1.1
  • The Events Calendar 6.1.2
  • The Events Calendar 6.1.2.1
  • The Events Calendar 6.1.2.2
  • The Events Calendar 6.1.3
  • The Events Calendar 6.1.4
  • The Events Calendar 6.2.0
  • The Events Calendar 6.2.0.1
  • The Events Calendar 6.2.1
  • The Events Calendar 6.2.2
  • The Events Calendar 6.2.2.1
  • The Events Calendar 6.2.3
  • The Events Calendar 6.2.3.1
  • The Events Calendar 6.2.3.2
  • The Events Calendar 6.2.4
  • The Events Calendar 6.2.5
  • The Events Calendar 6.2.6
  • The Events Calendar 6.2.6.1
  • The Events Calendar 6.2.7
  • The Events Calendar 6.2.8
  • The Events Calendar 6.2.8.1
  • The Events Calendar 6.2.8.2
  • The Events Calendar 6.3.0
  • The Events Calendar 6.3.1
  • The Events Calendar 6.3.3
  • The Events Calendar 6.3.3.1
  • The Events Calendar 6.3.4
  • The Events Calendar 6.3.5
  • The Events Calendar 6.3.6
  • The Events Calendar 6.3.7
  • The Events Calendar 6.4.0
  • The Events Calendar 6.4.0.1
  • The Events Calendar 6.5.0
  • The Events Calendar 6.5.0.1
  • The Events Calendar 6.5.1
  • The Events Calendar 6.5.1.1
  • The Events Calendar 6.5.1.2
  • The Events Calendar 6.5.1.3
  • The Events Calendar 6.5.1.4
  • The Events Calendar 6.5.1.5
  • The Events Calendar 6.5.1.6
  • The Events Calendar 6.5.2
  • The Events Calendar 6.6.0
  • The Events Calendar 6.6.0.1
  • The Events Calendar 6.6.0.2
  • The Events Calendar 6.6.1
  • The Events Calendar 6.6.2
  • The Events Calendar 6.6.3
  • The Events Calendar 6.6.4
  • The Events Calendar 6.6.4.1
  • The Events Calendar 6.6.4.2
  • The Events Calendar 6.7.0
  • The Events Calendar 6.7.1
  • The Events Calendar 6.8.0
  • The Events Calendar 6.8.1
  • The Events Calendar 6.8.2
  • The Events Calendar 6.8.2.1
  • The Events Calendar 6.9.0
  • The Events Calendar 6.9.1
  • The Events Calendar 6.10.0
  • The Events Calendar 6.10.1
  • The Events Calendar 6.10.3
  • The Events Calendar 6.11.0.1
  • The Events Calendar 6.11.1
  • The Events Calendar 6.11.2
  • The Events Calendar 6.11.2.1
  • The Events Calendar 6.13.0
  • The Events Calendar 6.13.1
  • The Events Calendar 6.13.2.1
  • The Events Calendar 6.14.0
  • The Events Calendar 6.14.1
  • The Events Calendar 6.14.2
  • The Events Calendar 6.15.0
  • The Events Calendar 6.15.0.1
  • The Events Calendar 6.15.1
  • The Events Calendar 6.15.1.1
  • The Events Calendar 6.15.2
  • The Events Calendar 6.15.3
  • The Events Calendar 6.15.4
  • The Events Calendar 6.15.5
  • The Events Calendar 6.15.6
  • The Events Calendar 6.15.8
  • The Events Calendar 6.15.9
  • The Events Calendar 6.15.10
  • The Events Calendar 6.15.12
  • The Events Calendar 6.15.12.1
  • The Events Calendar 6.15.12.2
  • The Events Calendar 6.15.13
  • The Events Calendar 6.15.13.1
  • The Events Calendar 6.15.14
  • The Events Calendar 6.15.15
  • The Events Calendar 6.15.16
  • The Events Calendar 6.15.17.1
  • The Events Calendar 6.15.18
  • The Events Calendar 6.15.19
  • The Events Calendar 6.15.20
  • The Events Calendar 6.16.0
  • The Events Calendar 6.16.1
  • The Events Calendar 6.16.2
  • The Events Calendar 6.16.3
  • The Events Calendar 6.16.4
  • The Events Calendar 6.16.4.1