CVE-2025-9808
published 2025-09-16CVE-2025-9808: The The Events Calendar plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.15.2 via the REST endpoint. This…
PriorityP338medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EXPLOIT
EPSS
0.77%
51.0th percentile
The The Events Calendar plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.15.2 via the REST endpoint. This makes it possible for unauthenticated attackers to extract information about password-protected vendors or venues.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| stellarwp | the_events_calendar | <= 6.15.2 | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Nuclei
The Events Calendar <= 6.15.2 - Information Disclosure
nuclei·CVSS 5.3
CVE-2025-9808 [MEDIUM] The Events Calendar <= 6.15.2 - Information Disclosure
The Events Calendar <= 6.15.2 - Information Disclosure
The Events Calendar WordPress plugin <= 6.15.2 contains an information disclosure vulnerability caused by REST endpoint exposure, letting unauthenticated attackers extract data about password-protected vendors or venues, exploit requires no authentication.
Template:
id: CVE-2025-9808
info:
name: The Events Calendar <= 6.15.2 - Information Disclosure
author: zer0p0int
severity: medium
description: |
The Events Calendar WordPress plugin <= 6.15.2 contains an information disclosure vulnerability caused by REST endpoint exposure, letting unauthenticated attackers extract data about password-protected vendors or venues, exploit requires no authentication.
impact: |
Unauthenticated attackers can access sensitive information about passwor
No writeups or analysis indexed.
2025-09-16
Published