WordPress - The Events Calendar - CRITICAL - CVE-2026-78159. The Events Calendar plugin for WordPress suffers from a vulnerability that allows unauthenticated attackers to execute arbitrary code on the server. This is primarily due to insufficient input validation of the 'classes' map within the parse_array function. When comments are enabled on tribe_events posts, attackers can trigger the vulnerability by submitting a crafted comment containing a wp:legacy-widget block. This malicious payload bypasses safety checks and reaches a vulnerable execution point in the code, enabling unauthorized command execution. Website administrators should ensure this plugin is updated to mitigate risks associated with this vulnerability.