Is CVE-2026-84740 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84740 being exploited in the wild.

How severe is CVE-2026-84740?

Medium severity, with a CVSS score of 6.5, published 2 October 2026.

Which products and versions are affected?

Modern Tribe The Events Calendar 6.12.0 to 6.17.5.

Is there a fix for CVE-2026-84740?

Yes: fixed in 6.17.5.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-84740 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-84740?

Check whether you run Modern Tribe The Events Calendar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84740: The Events Calendar WordPress plugin arbitrary shortcode execution

CVE-2026-84740 · Severity: medium · CVSS 6.5 · Published 2026-10-02

The Events Calendar is a popular WordPress plugin that manages event calendars and scheduling on websites. An unauthenticated attacker can execute arbitrary shortcodes on an affected site by submitting unvalidated data to an AJAX endpoint, potentially leading to unauthorized content modification, data exposure, or malicious code injection depending on what shortcodes are registered on the target site.

Vendors: Modern Tribe.

Quick answers

Is CVE-2026-84740 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84740 being exploited in the wild.
How severe is CVE-2026-84740?: Medium severity, with a CVSS score of 6.5, published 2 October 2026.
Which products and versions are affected?: Modern Tribe The Events Calendar 6.12.0 to 6.17.5.
Is there a fix for CVE-2026-84740?: Yes: fixed in 6.17.5.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84740 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-84740?: Check whether you run Modern Tribe The Events Calendar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 6.17.5.1

Technical details

The plugin fails to validate or sanitize user-supplied data in an unauthenticated AJAX action before merging it into the rendering context, allowing attackers to inject and execute arbitrary shortcodes. An unauthenticated attacker can exploit this via the 'view_data' parameter to trigger shortcode execution. The vulnerability affects versions 6.12.0 through 6.17.5 and is fixed in 6.17.5.1.

Affected products

Modern Tribe The Events Calendar 6.12.0 to 6.17.5

Timeline

2026-09-28: disclosed
2026-10-02: advisory
2026-10-02: patched: Fixed version 6.17.5.1 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.