CVE-2026-84740

Name of the Vulnerable Software and Affected Versions The Events Calendar WordPress plugin versions prior to 6.17.5.1

Description An unauthenticated AJAX action fails to validate or sanitize submitted data before merging it into the rendering context. This allows unauthenticated users to execute arbitrary shortcodes registered on the site.

Recommendations Update The Events Calendar WordPress plugin to version 6.17.5.1 or later.