Critical · 9.8 CVE-2026-95606 EUVD-2026-94491GHSA-39v2-8xcx-xqhh

WordPress The Events Calendar plugin <= 6.17.4 - PHP Object Injection vulnerability

Published Oct 7, 2026 · Updated Oct 7, 2026 · Assigned by Patchstack

Description

Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP The Events Calendar allows Object Injection.

This issue affects The Events Calendar: from n/a through 6.17.4.

Vendor	Product	Affected	Fixed
Liquid Web / StellarWP	The Events Calendar	≤ 6.17.4	—