---
title: "WordPress calendar plugin vulnerabilities: what to check now"
description: "Check whether your calendar plugin is affected. Compare its installed version with the patched release, back up the site, then update and test bookings."
url: "https://webleveling.com/blog/wordpress-calendar-plugin-vulnerabilities/"
lang: "en"
published: "2026-10-24"
modified: "2026-10-24"
author: "Cal Hewitt"
tags: ["website-security","wordpress","website-maintenance"]
image: "https://webleveling.com/og/blog-wordpress-calendar-plugin-vulnerabilities.jpg"
alternates:
  es: "https://webleveling.com/es/blog/vulnerabilidades-plugin-calendario-wordpress.md"
---

# WordPress calendar plugin vulnerabilities: what to check now

Check whether your calendar plugin is affected. Compare its installed version with the patched release, back up the site, then update and test bookings.

![A row of small brass hourglasses on a dark slate shelf, lit from one side.](https://webleveling.com/blog/wordpress-calendar-plugin-vulnerabilities/wordpress-calendar-plugin-featured.jpg)

A security headline about calendar plugins tends to show up at the wrong moment, while your site is still taking bookings and you cannot tell whether the plugin behind them is on the list. A WordPress calendar plugin vulnerability affects your site only when it runs one of the named plugins, or a vulnerable related add-on, at a version older than the fixed one.

The check takes a few minutes. Open Plugins in your dashboard, read the version number beside each calendar, events or booking plugin, and compare it with the fixed version for that plugin.

An older version means your site is exposed to a documented flaw. Whether anyone used that flaw is a separate question, and only one of the four plugins covered here has an entry marked as exploited. Keep exposure, exploitation and confirmed compromise apart, and the next steps get a lot clearer.

**Key Takeaways**

**Compare versions first**

Open Plugins, record the version of every calendar, events, booking, appointment, registration and ticket plugin, and compare each with its fixed version.

**Update The Events Calendar first**

CVE-2026-78159 is unauthenticated remote code execution with a CVSS score of 9.8, fixed in 6.17.3.1, and Patchstack marks it "Known to be exploited."

**The other three are lower rated**

Booking Calendar, Events Manager and Eventin each have a CVSS 5.3 entry with a fixed version, published between October 5 and October 13, 2026.

**An update closes the gap, not the question**

Back up, update, test bookings, then review users and bookings, because an update by itself does not show that nobody reached the site.

## Know in minutes whether your calendar plugin has a fix waiting

Four calendar, events and booking plugins have a published advisory with a CVE number since September 11, 2026. Find your plugin in the table, then compare the installed version in your Plugins screen with the "Fixed in" column. A site is affected when its version is in the affected range.

Calendar, events and booking plugin advisories, September 11 to October 13, 2026

| Plugin | CVE | Severity and flaw | Affected versions | Fixed in | Published |
| --- | --- | --- | --- | --- | --- |
| The Events Calendar | CVE-2026-78159 | CVSS 9.8, unauthenticated remote code execution | Through 6.17.3 | 6.17.3.1 | September 11, 2026 |
| Booking Calendar | CVE-2026-18496 | CVSS 5.3, unauthenticated sensitive-data exposure | Through 11.4.3 | 11.5 | October 9, 2026 |
| Events Manager | CVE-2026-105068 | CVSS 5.3, unauthenticated information exposure | Through 7.4.5 | 7.4.6 | October 5, 2026 |
| Eventin (listed by Patchstack as WP Event Solution) | CVE-2026-109898 | CVSS 5.3, unauthenticated broken access control | Through 4.1.25 | 4.1.26 | October 13, 2026 |

The Events Calendar is the entry to handle first. Patchstack's [advisory for CVE-2026-78159](https://patchstack.com/database/wordpress/plugin/the-events-calendar/vulnerability/wordpress-the-events-calendar-plugin-6-17-3-unauthenticated-code-injection-to-remote-code-execution-vulnerability) describes unauthenticated remote code execution, which means a visitor with no account could run code on your server. It marks the flaw "Known to be exploited" and says to update to version 6.17.3.1 or later.

Patchstack keeps a running list of every [Events Calendar vulnerability](https://patchstack.com/database/wordpress/plugin/the-events-calendar/vulnerabilities), and the [Eventin entries](https://patchstack.com/database/wordpress/plugin/wp-event-solution/vulnerabilities) are listed under the name WP Event Solution. Check both lists for the exact plugin you run, since a premium extension can carry its own version number.

![A blank desk planner page with faint pencil marks lying beside a closed laptop on a wooden desk.](https://webleveling.com/blog/wordpress-calendar-plugin-vulnerabilities/calendar-plugin-desk-planner.jpg)

Write down the version of every calendar, events and booking plugin before you change anything.

## Put the right warning first and spend your evening wisely

The four entries do not carry the same weight, and treating them alike wastes time you need for the one that matters. The Events Calendar flaw needs no login, runs code on the server and is reported as exploited. That puts it ahead of everything else on your list tonight.

Booking Calendar's CVE-2026-18496 exposes sensitive data without a login, and it is fixed in 11.5. Patchstack generally rates its [Booking Calendar advisories](https://patchstack.com/database/wordpress/plugin/booking/vulnerabilities) as low priority, and the plugin's flaws have ranged from data exposure and access-control failures to reflected cross-site scripting and a race condition. Low priority is a reason to schedule the update, not to skip it.

Events Manager's CVE-2026-105068 is an information exposure fixed in 7.4.6, and Patchstack's page for [Events Manager 7.4.5](https://patchstack.com/database/wordpress/plugin/events-manager/vulnerability/wordpress-events-manager-plugin-7-4-5-sensitive-data-exposure-vulnerability) lists it as sensitive data exposure. Eventin's CVE-2026-109898 is a broken access control fixed in 4.1.26, which means a function that should check who is asking does not.

Move to the current release rather than stopping at the minimum fixed version. WordPress.org lists The Events Calendar at 6.18.2, Events Manager at 7.4.10, Booking Calendar at 11.9.1 and Eventin at 4.1.28 as of October 24, 2026. The Events Calendar's [WordPress.org page](https://wordpress.org/plugins/the-events-calendar/) records security hardening in 6.17.3.1, 6.17.4.1 and 6.17.5.1, so a site that stopped at the first fix has later changes to pick up. Booking Calendar and Eventin each have other 2026 advisories as well.

Those plugins are widely installed. WordPress.org lists about 600,000 active installations for The Events Calendar, 60,000 for Events Manager, 40,000 for Booking Calendar and 10,000 for Eventin, and all four show recent updates. Being active and maintained is why a fixed version exists. It does not protect a site that has not installed it.

## Update without breaking the booking page your customers use

The routine is short, and you can do all of it yourself. The order matters, because a backup you take after the update cannot undo a bad update. If you manage several sites or keep losing track of what changed, our guide to [checking WordPress plugins for urgent security updates](https://webleveling.com/blog/check-wordpress-plugins-for-urgent-security-updates/) covers the habit of reviewing the whole plugin list.

1.  **Find every candidate**: In Plugins, then Installed Plugins, search for calendar, events, booking, appointment, registration and tickets, and write down each name and version.
2.  **Compare with the fixed version**: Use the fixed versions in the table and the plugin's own page to see whether your number is older.
3.  **Back up the site**: Take a current backup of the files and the database before touching anything.
4.  **Update the plugin and its add-ons**: Update the main plugin, then any extension or premium add-on from the same vendor.
5.  **Test the customer path**: Load the calendar page, an event page, the registration form, the payment flow and the confirmation email.

WordPress's own documentation on [managing plugins](https://wordpress.org/documentation/article/manage-plugins/) walks through updating from the Plugins screen and reviewing compatibility. If you are not sure you have a clean backup, [how to back up a small business website](https://webleveling.com/blog/how-to-back-up-a-small-business-website/) shows what a usable one contains.

Test with a real booking from a phone, not just a glance at the calendar. A calendar can look fine while a confirmation email stops sending or a payment step fails, and you want to find that before a customer does.

![A small external hard drive with a coiled cable resting beside a closed laptop on a clean desk.](https://webleveling.com/blog/wordpress-calendar-plugin-vulnerabilities/calendar-plugin-backup-drive.jpg)

A backup taken before the update is what lets you undo a bad one.

WordPress's [hardening guidance](https://developer.wordpress.org/advanced-administration/security/hardening/) tells site owners to "make sure your plugins are always updated" and, "if you are not using a specific plugin, delete it from the system." Two calendar plugins on one site, with one of them switched off, is the common leftover. Confirm nothing on your pages or in your bookings depends on it, then delete it.

## Keep taking bookings safely when the update has to wait

Sometimes the update cannot go in tonight. The site may have a custom integration, a failed update from last time, or no staging copy to test on. In that case the aim is to shrink the exposure until someone can apply the fix properly.

Pause the public parts of the calendar plugin: front-end event submission, open registration and online booking intake, if you can take those by phone or email for a day. The Events Calendar flaw needs no login, so a public door left open is the risk that matters.

Then ask your host or developer to apply the update and to review the server logs. Give them the plugin name, the installed version and the fixed version from the table, so they do not have to guess. Patchstack's advisory pages recommend updating immediately and, in some cases, offer temporary mitigation rules while you wait.

If your host manages updates, ask whether the calendar plugin is included, because some hosting plans cover WordPress core but not third-party plugins. A recent post on [what to check on your WordPress host after a software flaw](https://webleveling.com/blog/check-your-wordpress-host-for-image-library-flaws/) lists the questions to put to them.

![A brass padlock resting on a closed wooden appointment book on a worn shop counter.](https://webleveling.com/blog/wordpress-calendar-plugin-vulnerabilities/calendar-plugin-padlock-ledger.jpg)

Pausing public submissions closes the door while you wait for the update.

## Find out whether anyone got in before you updated

An update closes the hole going forward. It does not show that nobody used the hole earlier. For The Events Calendar, where Patchstack reports exploitation, the days between September 11 and your update are worth a look. For the other three, a quick review is sensible and a panic is not.

Start with accounts. WordPress's [roles and capabilities](https://wordpress.org/documentation/article/roles-and-capabilities/) documentation explains that administrators can install, update and delete plugins, while editors, authors, contributors and subscribers have narrower powers. Remove former staff and contractors, drop any role that is higher than the person needs, and look for administrator accounts you do not recognize.

Next, look at the content. Scan recent events and bookings for entries you did not create, odd links in event descriptions and new pages you did not publish. Your host's logs can show unusual requests to the calendar plugin around the time of the advisory, which is the part a developer helps with.

If you do find a sign of compromise, preserve what you have, restore only from a backup you know is clean, update the plugin before the site goes public again, and change every administrator and hosting password. A restore from an old backup can bring back the vulnerable plugin version, so update right after. Our walkthrough of the [first 24 hours after a hacked website](https://webleveling.com/blog/website-hacked-first-24-hours/) covers that sequence in order.

A vulnerable plugin on an outdated server stacks two problems, so ask your host at the same time whether it has applied the [critical PHP security update](https://webleveling.com/blog/php-critical-security-update-what-to-do/).

![A ring of spare keys and a blank paper tag on a wooden shelf beside a closed toolbox.](https://webleveling.com/blog/wordpress-calendar-plugin-vulnerabilities/calendar-plugin-spare-keys.jpg)

Fewer people with keys to the dashboard means fewer ways in.

## Decide whether to fix it yourself or hand it off

You can do the version check and the update on your own. For a simple site with a current backup, one calendar plugin and a handful of administrators, that is a ten-minute job plus testing, and no audit is needed.

Paying for [website maintenance](https://webleveling.com/services/website-maintenance/) or a security review earns its cost in specific situations: the site takes paid bookings, it runs custom integrations or premium add-ons, there is no current backup, nobody can say who has access, a past update failed, you see any sign of compromise, or there is no staging copy to test on. In those cases a mistake costs more than the help does.

What a review adds is not a secret version number, which anyone can read in the Plugins screen. It is a check of the whole plugin family, a safe update that keeps the booking path working, and a look at whether the site was changed while it was exposed. That is the part that is hard to do from a headline.

**Quiz: Is your calendar plugin handled?**

1. Which version of The Events Calendar fixes CVE-2026-78159?
   - 6.17.2
   - 6.17.3
   - 6.17.3.1 **(correct answer)**
   - 6.16.0
2. Which of the four plugins named here has an entry that Patchstack marks "Known to be exploited"?
   - Booking Calendar
   - The Events Calendar **(correct answer)**
   - Events Manager
   - Eventin
3. You updated the plugin and bookings work. What does that tell you?
   - That nobody ever reached the site
   - That the flaw was never used
   - That the gap is closed going forward, but users, bookings and logs still deserve a look **(correct answer)**
   - That you can skip the next backup

## Frequently Asked Questions About WordPress Calendar Plugin Vulnerability

**How do I check whether my calendar plugin is affected?**

Open Plugins in WordPress, find the calendar, events or booking plugin, and compare its installed version with the affected range and fixed version for that plugin. A version at or below the affected number needs an update.

**What should I update first?**

The Events Calendar, if you run it. CVE-2026-78159 is unauthenticated remote code execution rated CVSS 9.8, fixed in 6.17.3.1, and Patchstack marks it known exploited. Then update Booking Calendar, Events Manager and Eventin as each applies.

**Should I turn off bookings?**

Pause public submissions and online intake only if a vulnerable plugin cannot be updated promptly. Once the fixed version is installed and tested, turn them back on.

**Does a vulnerability prove my site was hacked?**

No. It shows exposure to a documented flaw. Review administrator accounts, recent bookings, files and logs to judge whether anything was used.

**Can I delete a calendar plugin I no longer use?**

Yes, after confirming that no page, booking, payment or add-on depends on it. Deactivate it first, back up the site, then delete it.

**What version of Booking Calendar is safe?**

CVE-2026-18496 affects versions through 11.4.3 and is fixed in 11.5. WordPress.org lists 11.9.1 as current, so update to the latest release rather than stopping at 11.5.

## Moving Forward

Check the version of every calendar, events and booking plugin you run, compare it with its fixed version, back up the site, update and test the booking path. The Events Calendar comes first because CVE-2026-78159 is unauthenticated, rated CVSS 9.8 and reported as exploited. Booking Calendar, Events Manager and Eventin follow, each with a fixed version published in October 2026.

A short routine like this also makes the next security notice easier to read. You will know which plugins you run, who has access, where the backup is and how to test a booking, so a headline turns into a ten-minute check rather than a late-night worry.

If you would rather have someone confirm all of it, [Web Leveling](https://webleveling.com/) can run a [website security audit](https://webleveling.com/services/website-security-audit/) across your plugins, user accounts and logs, and our [web design](https://webleveling.com/services/web-design/) team builds booking systems you own when a calendar plugin has to be replaced. We work with small and medium businesses across the country and overseas. [Tell us which calendar or booking plugin your site runs](https://webleveling.com/contact/), and we will tell you what to check first.

## Terms

Calendar plugin security words

Tap a term to see what it means.

**CVE.** A public identifier, such as CVE-2026-78159, given to a specific security flaw so everyone refers to the same one.

**CVSS.** A score from 0 to 10 that rates how severe a flaw is; 9.8 is critical and 5.3 is medium.

**Unauthenticated.** Needing no login, so any visitor to the site could trigger the flaw.

**Remote code execution.** A flaw that lets an outsider run their own code on the server.

**Broken access control.** A missing check on who may do something, so a visitor can reach a function they should not.

**Fixed version.** The first release of a plugin that closes a flaw; any older version is still exposed.

**Staging site.** A private copy of your site used to test an update before it reaches customers.

- [PHP security update: check your version and ask your host](https://webleveling.com/blog/php-critical-security-update-what-to-do/): Check your PHP version under Tools > Site Health > Info > Server, then ask your host if the October 21, 2026 PHP fix is installed for your site.
- [Ghostscript Vulnerability and PDF Uploads: Check Today](https://webleveling.com/blog/ghostscript-flaw-pdf-uploads-wordpress/): A Ghostscript vulnerability can reach WordPress sites through PDF uploads. List your upload forms, ask your host one question and update WordPress today.
- [All in One SEO and Bricksforge flaws: what to update first](https://webleveling.com/blog/bricksforge-all-in-one-seo-wordpress-flaws/): Bricksforge needs 4.0.1 or newer and All in One SEO needs 5.0.2.1 or newer. Update Bricksforge first, then check users, files and redirects for damage.