Live › vulnerability › CVE-2026-110903
Go to dashboardThe Events Calendar, a WordPress plugin by Liquid Web and StellarWP, fails to neutralize input when generating web pages, enabling stored cross-site scripting. An attacker who can store malicious input in the plugin's fields can run script in other users' browsers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running The Events Calendar 6.18.1 or earlier are affected. Exposure depends on who can submit content the plugin later renders to visitors or administrators; sites where only trusted editors can enter event data carry less risk. unknown whether the sources name specific configurations.
No product ranges from the sources yet.
wp plugin get the-events-calendar --field=version6.18.1, per the vendor's releaseEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through 6.18.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-110903")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.