Wordfence (CVE records published 12 September 2026, crediting Chloe Chamberland and Wordfence Argus) documents two critical unauthenticated remote-code-execution chains in StellarWP The Events Calendar plugin (600,000+ active installations per WordPress.org). CVE-2026-78159 (CVSS 9.8; versions up to and including 6.17.3): unauthenticated code injection via insufficient validation of the widget 'classes' map, triggered when the single-event HTML including the comment area is processed; it requires comments enabled on events and a crafted comment — version 6.17.3.1 is dated 26 August 2026 in the plugin's changelog.

CVE-2026-78006 (CVSS 9.8; versions up to and including 6.17.4): unauthenticated PHP object injection when event comments are enabled/visible — payload reaches the vulnerable path before moderation; patched in 6.17.4.1 (10 September 2026). Both can fully compromise the WordPress site.

Update to 6.17.4.1 or later. (sources: Wordfence; CVE.org; WordPress.org)

Correction (27 Oct 2026): the card said 6.17.3.1 was released on 25 August; the plugin's WordPress.org changelog dates it 26 August 2026. Removed an estimate of about 240,000 sites on vulnerable branches, which no readable source states. The vendor link now points to the plugin's WordPress.org page because theeventscalendar.com now redirects to another site, and the card is now dated 12 September, when the CVE records were published. (source: WordPress.org; CVE.org)

Correction (29 Oct 2026): removed a SecurityWeek link and internal source labels. (source: WordPress.org)