What WordPress Calendar Vulnerabilities Reveal About Trusting User Content
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
Two unauthenticated remote code execution flaws in the WordPress Events Calendar plugin, CVE-2026-78159 and CVE-2026-78006, let attackers reset admin passwords or run code on affected sites, with fixes in versions 6.17.3.1 and 6.17.4.1.