CVE-2026-95606: CWE-502 Deserialization of Untrusted Data in Liquid Web / StellarWP The Events Calendar

This vulnerability (CVE-2026-95606) in The Events Calendar plugin by Liquid Web / StellarWP involves deserialization of untrusted data (CWE-502), which enables object injection attacks. The affected versions include all releases up to 6.17.4. The CVSS 3.1 score of 9.8 reflects that the vulnerability can be exploited remotely without privileges or user interaction, resulting in complete compromise of confidentiality, integrity, and availability of the affected system. No vendor advisory or patch information is currently available.

Successful exploitation allows an attacker to perform object injection via deserialization of untrusted data, potentially leading to full system compromise including unauthorized data access, modification, and denial of service. The vulnerability is remotely exploitable without authentication or user interaction, making it highly severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or restricting access to the affected plugin to reduce exposure.