Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?GeoDirectoryevents-for-geodirectory
Plugin · events-for-geodirectory
events-for-geodirectory
3 known vulnerabilities on record. Add your version above to see which ones affect you.
Jun 15, 2026Contributor PHP Object Injection in Events Calendar for GeoDirectory <= 2.3.25 versions.CVE-2026-39532 · affects up to 2.3.25 · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in Events Calendar for GeoDirectory <= 2.3.25 versions.
Jun 9, 2026Events Calendar for GeoDirectory: Privilege EscalationCVE-2026-11616 · affects up to 2.3.28 · reported by WordfenceHigh 8.8
The Events Calendar for GeoDirectory plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 2.3.28. This is due to the ajax_ayi_action() handler only applying strip_tags(esc_sql()) — with no allow-list — to the attacker-controlled $_POST['type'] and $_POST['postid'] values before forwarding them to update_ayi_data(), which calls update_user_meta($current_user->ID, $rsvp_args['type'], $posts). By passing type=wp_capabilities and postid=administrator, an attacker writes ['subscriber'=>true,'administrator'=>'administrator'] into their own wp_capabilities user meta; WP_User::get_role_caps() then treats the 'administrator' array key as an active role on the next request. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to Administrator.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 3, 2025Events Calendar for GeoDirectory: Deserialization of Untrusted DataCVE-2025-26967 · affects up to 2.3.14 · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Stiofan Events Calendar for GeoDirectory events-for-geodirectory allows Object Injection.This issue affects Events Calendar for GeoDirectory: from n/a through <= 2.3.14.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.