Stiofansisland Events Calendar For Geodirectory vulnerabilities

CVE-2026-11616 [HIGH] CWE-269 CVE-2026-11616: The Events Calendar for GeoDirectory plugin for WordPress is vulnerable to Privilege Escalation in v The Events Calendar for GeoDirectory plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 2.3.28. This is due to the ajax_ayi_action() handler only applying strip_tags(esc_sql()) — with no allow-list — to the attacker-controlled $_POST['type'] and $_POST['postid'] values before forwarding them to update_ayi_data()