Risk Letters

Exploited vulnerability

CVE-2026-78159

TLP:CLEAR

StellarWP the_events_calendar Improper Control of Generation of Code ('Code Injection')

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the is_safe_widget_instance() object check and reach the callable-invocation sink in Element_Classes::parse_array(). This makes it p

Facts

  • Vendor: StellarWP
  • Product: the_events_calendar
  • CVSS: 9.8
  • EPSS (probability of exploitation within 30 days): 1.4 %
  • First known exploitation: 14 September 2026
  • First seen by Risk Letters: 12 September 2026

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD