Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The The Events Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the ‘s’ parameter in all versions up to, and including, 6.15.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Bricks And Minifigs We steal from old people Who want to try https://bricksandminifigs.com/ Wordpress The Events Calendar 6.5.1.5 → CVE-2025-9807 unauth SQLi
Post summary
The tweet notes a WordPress plugin vulnerability (CVE-2025-9807) involving unauthenticated SQL injection, but offers no PoC, exploit code, patch information, or evidence of active exploitation.