SQL Injection Vulnerability in The Events Calendar Plugin for WordPress

CVE-2025-9807

What is CVE-2025-9807?

The Events Calendar plugin for WordPress has a vulnerability that allows unauthenticated attackers to perform time-based SQL Injection through the 's' parameter. This is due to inadequate escaping of user-supplied input and insufficient preparation of SQL queries. By exploiting this flaw, attackers can inject additional SQL queries into existing ones, resulting in unauthorized access to sensitive information within the database. It is crucial for users of this plugin to apply necessary updates to mitigate potential risks.

References