CVE-2026-49772

CRITICAL

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP The Events Calendar allows Blind SQL Injection. This issue affects The Events Calendar: from 6.15.12 through 6.16.2.

StatusDeferred

설명

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP The Events Calendar allows Blind SQL Injection.

This issue affects The Events Calendar: from 6.15.12 through 6.16.2.

Score Summary

CVSS Score: 9.3
Version: 3.1
VPI: 93
Why this VPI (explainable, experimental)
VPI breakdown
Impact 93.00
Exploitation signal(No additional exploitation signal) ×1.00
VPI 93.00
VPI formula vpi-v1
EPSS: 0.2%
(상위 13.7%)
Attack Vector: Network
Low Complexity
No Privileges
No User Interaction
Scope Changed
High Confidentiality Impact
No Integrity Impact
Low Availability Impact

Details

Published: 06/16/2026(last month)
Modified: 06/16/2026(last month)
Source: NVD

CWE Weakness Classification

CWE-89
NVD
Primary

References (1)

NVD
https://patchstack.com/database/wordpress/plugin/the-events-calendar/vulnerability/wordpress-the-events-calendar-plugin-6-15-12-6-16-2-sql-injection-vulnerability?_s_id=cve

목록으로

Dashboard

Vulnerabilities

Impact	93.00
Exploitation signal(No additional exploitation signal)	×1.00
VPI	93.00