WordPress - The Events Calendar - CRITICAL - CVE-2026-49772. An SQL injection vulnerability exists in The Events Calendar plugin developed by Liquid Web and StellarWP, allowing for unauthorized access to the database through specifically crafted SQL commands. This can lead to sensitive data exposure or manipulation, impacting the integrity and security of affected WordPress installations. Versions from 6.15.12 to 6.16.2 are vulnerable, making it crucial for users to apply necessary updates to mitigate risks.