This vulnerability in Events Calendar for GeoDirectory arises from unsafe deserialization of untrusted input, enabling attackers with at least low privileges to inject malicious objects. The flaw affects all versions up to 2.3.14. The CVSS v3.1 score is 8.8, reflecting network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch links are currently provided, and the product is not a cloud service.

Successful exploitation could allow an attacker to execute arbitrary code or perform unauthorized actions within the context of the affected application, resulting in full compromise of confidentiality, integrity, and availability. The vulnerability requires low privileges but no user interaction, making it relatively easy to exploit remotely.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and monitor for unusual activity. Avoid using versions up to 2.3.14 in production environments if possible.