{"id":"CVE-2026-110903","kind":"vulnerability","aliases":["CVE-2026-110903"],"related":[],"title":"The Events Calendar WordPress plugin: stored XSS through 6.18.1","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through 6.18.1.","summary":"The Events Calendar, a WordPress plugin by Liquid Web and StellarWP, fails to neutralize input when generating web pages, enabling stored cross-site scripting. An attacker who can store malicious input in the plugin's fields can run script in other users' browsers.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","the-events-calendar","wordpress"],"not_affected_if":["plugin-version-above-6.18.1"],"how_to_check":"- Check the installed The Events Calendar plugin version in the WordPress admin under Plugins, or with `wp plugin get the-events-calendar --field=version`\n- Compare the installed version against 6.18.1 and older","fix":"- Update The Events Calendar to a version later than `6.18.1`, per the vendor's release\n- unknown whether a patched version number is published in the sources","status":"open","published_at":"2026-10-16T13:16:55+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:57:55+00:00","updated_at":"2026-10-25T03:57:55+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:57:55Z","model":"claude-haiku-5-5","output":{"fix":"- Update The Events Calendar to a version later than `6.18.1`, per the vendor's release\n- unknown whether a patched version number is published in the sources\n","reach":"internet","title":"The Events Calendar WordPress plugin: stored XSS through 6.18.1","impact":"medium","summary":"The Events Calendar, a WordPress plugin by Liquid Web and StellarWP, fails to neutralize input when generating web pages, enabling stored cross-site scripting. An attacker who can store malicious input in the plugin's fields can run script in other users' browsers.","category":"package","nicknames":[],"who_cares":["wordpress","the-events-calendar","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker script runs in victims' browsers on the site","analyst_note":"Confirm which input fields and privilege level are needed to store the payload, and find the patched version number at the NVD entry or vendor changelog.","how_to_check":"- Check the installed The Events Calendar plugin version in the WordPress admin under Plugins, or with `wp plugin get the-events-calendar --field=version`\n- Compare the installed version against 6.18.1 and older\n","needs_analyst":true,"not_affected_if":["plugin-version-above-6.18.1"],"who_is_affected":"Sites running The Events Calendar 6.18.1 or earlier are affected. Exposure depends on who can submit content the plugin later renders to visitors or administrators; sites where only trusted editors can enter event data carry less risk. unknown whether the sources name specific configurations.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000625,"input_tokens":3322,"output_tokens":586,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110903':12A,15A '-2026':11A,14A '6.18.1':9A,104C 'affect':97C 'allow':93C 'attack':51B 'browser':68B 'calendar':3A,23B,27B,88C,92C,100C 'cross':47B,78C 'cross-sit':46B,77C 'cve':10A,13A 'enabl':44B 'event':2A,22B,26B,87C,91C,99C 'fail':36B 'field':61B 'generat':41B,76C 'host':19B 'improp':69C 'input':39B,56B,72C 'issu':96C 'liquid':32B,83C 'malici':55B 'n/a':102C 'neutral':38B,70C 'packag':16B 'page':43B,75C 'plugin':5A,30B,59B 'run':63B 'script':49B,64B,80C 'self':18B 'self-host':17B 'site':48B,79C 'stellarwp':35B,85C 'store':6A,45B,54B,94C 'the-events-calendar':20B,89C 'user':67B 'vulner':81C 'web':33B,42B,74C,84C 'wordpress':4A,24B,29B 'xss':7A 'xss.this':95C","nicknames":[],"mitigations":[],"who_affected":"Sites running The Events Calendar 6.18.1 or earlier are affected. Exposure depends on who can submit content the plugin later renders to visitors or administrators; sites where only trusted editors can enter event data carry less risk. unknown whether the sources name specific configurations.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T13:16:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110903","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110903","severity":null,"published_at":"2026-10-16T13:16:55+00:00","modified_at":"2026-10-16T15:19:36+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}