Critical RCE in The Events Calendar plugin (CVE-2026-78159)

Two CVSS 9.8 unauthenticated RCE flaws in The Events Calendar WordPress plugin headline this digest.

2026-09-12 10:13 UTC

🔓 CVEs & KEV

CVE-2026-78159 — CVSS 9.8 — The Events Calendar through 6.17.3 - Unauthenticated Code Injection to Remote Code...
CVE-2026-78006 — stellarwp The Events Calendar — CVSS 9.8 — The Events Calendar through 6.17.4 - Unauthenticated PHP Object Injection to Remot...

Start with the free Posture Self-Check to see where you stand against the current threat landscape.