Blind SQL Injection Vulnerability in The Events Calendar Plugin for WordPress

CVE-2025-12197

What is CVE-2025-12197?

The Events Calendar plugin for WordPress contains a blind SQL injection vulnerability that can be exploited via the 's' parameter in versions 6.15.1.1 to 6.15.9. This flaw arises from inadequate escaping of user-supplied input and insufficient preparation of SQL queries. As a result, unauthenticated attackers may exploit this vulnerability to inject additional SQL commands, potentially leading to unauthorized access and extraction of sensitive information from the database.

References