CVE-2024-8275criticalexplotación observadaCWE-89

CVE-2024-8275: fallo crítico en stellarwp The Events Calendar

The Events Calendar <= 6.6.4 - Unauthenticated SQL Injection

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear The Events Calendar

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

82Vexday Risk Score

Prioriza la corrección. Ella explotación observada por VulnCheck y tiene prueba de concepto pública.

ssvc Actcvss 9.8epss 50%
de la publicación al arma1 día
Publicada en NVD25 sept
1ª PoC+1d
VulnCheck+748d
The The Events Calendar plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tribe_has_next_event' function in all versions up to, and including, 6.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Only sites that have manually added tribe_has_next_event() will be vulnerable to this SQL injection.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
stellarwp · The Events Calendar
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — stellarwp The Events Calendar

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-12197HIGHThe Events Calendar 6.15.1.1 - 6.15.9 - Unauthenticated SQL Injection via sEPSS 18.2%CVE-2024-6931HIGHThe Events Calendar <= 6.6.3 - Unauthenticated Stored Cross-Site ScriptingEPSS 16.7%CVE-2026-78006CRITICALThe Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code ExecutionEPSS 1.5%CVE-2026-78159CRITICALThe Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable InvocationEPSS 1.4%CVE-2025-9808MEDIUMThe Events Calendar <= 6.15.2 - Missing Authorization to Unauthenticated Password-Protected Information DisclosureEPSS 0.8%CVE-2023-6557MEDIUMThe Events Calendar <= 6.2.8.2 - Unauthenticated Sensitive Information ExposureEPSS 0.6%