CVE-2026-13119

Name of the Vulnerable Software and Affected Versions Registrations For The Events Calendar versions prior to 3.3

Description Authenticated attackers with Contributor-level access or higher who can edit a targeted event can perform SQL Injection. The issue occurs when the rtec records edit AJAX action processes the standard parameter. The handler decodes JSON from $ POST['standard'] and uses the JSON array keys as column identifiers in an UPDATE statement within the update entry() function of the RTEC Db Admin class. Because the esc sql() function does not escape spaces, equals signs, parentheses, or hyphens, an attacker can break the identifier context to inject subqueries and extract sensitive information from the database.

Recommendations Update to a version newer than 3.2.