Loading story…
A PHP object-injection vulnerability affects The Events Calendar WordPress plugin, including version 6.17.2. The flaw could allow unsafe deserialization of attacker-controlled data, potentially enabling malicious object manipulation in vulnerable WordPress installations.
Site administrators should identify deployments of The Events Calendar and update to the vendor-fixed release as soon as available. Until patched, restrict untrusted input paths, review plugin activity and application logs for suspicious serialized payloads, and remove or disable the plugin where it is not required.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
A PHP object injection vulnerability was identified as affecting the WordPress The Events Calendar plugin, including version 6.17.2 referenced by Patchstack.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two critical unauthenticated vulnerabilities in StellarWP's **The Events Calendar** WordPress plugin—`CVE-2026-78006` and `CVE-2026-78159`, both rated CVSS 9.8—can enable takeover of more than 600,000 active sites. The flaws abuse attacker-controlled comment content processed as Gutenberg blocks and the plugin's generation of integrity hashes for legacy-widget instances. `CVE-2026-78006` permits PHP object injection and arbitrary operating-system command execution, while `CVE-2026-78159` can invoke arbitrary PHP callables; researchers demonstrated an administrator-password reset that can lead to site compromise and remote code execution. Exploitation requires comments to be enabled and displayed on event posts, but requires no account, registration, or moderator approval: attackers can abuse the pending-comment moderation-preview flow. StellarWP addressed `CVE-2026-78159` in version 6.17.3.1 and both vulnerabilities in **6.17.4.1**. Administrators should update immediately, review event-post comment configurations, investigate administrator accounts for unauthorized changes, and examine logs for suspicious comment or moderation-preview activity.
Sep 17, 2026
Two high-severity vulnerabilities have been disclosed in WordPress plugins using the `JS` branding, affecting sites that have not updated to fixed versions. `CVE-2026-32534` impacts JoomSky's **JS Help Desk** plugin (`js-support-ticket`) through version `3.0.3` and allows **blind SQL injection** due to improper neutralization of special elements in SQL commands. The issue is rated `CVSS 3.1 8.6` with vector `AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L`, indicating network-reachable exploitation with low attack complexity and significant confidentiality impact.
Jun 29, 2026
Two high-severity vulnerabilities have been disclosed in popular WordPress snippet-management plugins, exposing sites to **remote code execution** through `CWE-94` code injection flaws. `CVE-2026-25001` affects **Post Snippets** by Saad Iqbal in versions through `4.0.12`, while `CVE-2026-25366` affects **Woody ad snippets** (`insert-php`) by Themeisle in versions through `2.7.1`. Both issues were documented with Patchstack references and indicate that attackers could inject or include malicious code on vulnerable WordPress installations. The two CVEs differ in attack complexity but both carry severe impact to confidentiality, integrity, and availability. `CVE-2026-25001` is scored with `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H`, while `CVE-2026-25366` carries `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`, making the Woody ad snippets flaw easier to exploit once low privileges are obtained. Organizations running either plugin should identify affected versions, prioritize updates beyond the vulnerable releases, and review WordPress environments for signs of unauthorized code execution.
Jun 29, 2026