CurlyThemes vulnerabilities and threats

CVE-2025-69135 is a high severity SQL Injection vulnerability in the Events Schedule - WordPress Events Calendar Plugin by CurlyThemes affecting versions up to and including 2.7.2. The flaw allows an attacker with subscriber-level privileges to inject SQL commands due to improper neutralization of special elements in SQL queries. This vulnerability can lead to high confidentiality impact and low availability impact but does not affect integrity. No official patch or remediation guidance is currently available from the vendor.