Description
The The Events Calendar plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.15.2 via the REST endpoint. This makes it possible for unauthenticated attackers to extract information about password-protected vendors or venues.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| stellarwp | The Events Calendar | ≤ 6.15.2 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- The Events Calendar <= 6.15.2 - Information Disclosure http/cves/2025/CVE-2025-9808.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.