PT-2025-37866 · Stellarwp+1 · The Events Calendar

Miguel Santareno · Published 2025-09-16 · Updated 2025-12-20 · CVE-2025-9808

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions The Events Calendar plugin for WordPress versions prior to 6.15.3

Description The Events Calendar plugin for WordPress is susceptible to information disclosure through the REST endpoint. This allows unauthenticated attackers to extract information about password-protected vendors or venues. The affected API endpoint is not specified. The vulnerable data includes information related to vendors and venues.

Recommendations Update The Events Calendar plugin to version 6.15.3 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-9808

Affected Products

The Events Calendar

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-9808 · Security Note
• https://twitter.com/pdnuclei_bot/status/2002287893327585703 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3359403 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/0f2968d6-f1b1-4cd5-b76b-9dc0f6dd1a6a?source=cve · Note