{"id":"CVE-2026-119369","kind":"vulnerability","aliases":["CVE-2026-119369"],"related":[],"title":"The Events Calendar WordPress plugin: stored XSS through version 6.18.2","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through 6.18.2.","summary":"The Events Calendar plugin by Liquid Web and StellarWP lets stored cross-site scripting payloads be saved and later run in visitors' browsers. An attacker who can enter content can run script in the context of other users, including site administrators.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","the-events-calendar","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed The Events Calendar plugin version in the WordPress admin Plugins screen\n- Compare the installed version against `6.18.2` and earlier releases listed as affected","fix":"- The Events Calendar: a version later than `6.18.2` (the sources do not name the exact fixed release)","status":"open","published_at":"2026-10-30T16:17:43+00:00","first_seen_at":"2026-10-30T16:31:25+00:00","triaged_at":"2026-10-30T16:32:20+00:00","updated_at":"2026-10-30T16:32:20+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T16:32:20Z","model":"claude-haiku-5-5","output":{"fix":"- The Events Calendar: a version later than `6.18.2` (the sources do not name the exact fixed release)","reach":"internet","title":"The Events Calendar WordPress plugin: stored XSS through version 6.18.2","impact":"medium","summary":"The Events Calendar plugin by Liquid Web and StellarWP lets stored cross-site scripting payloads be saved and later run in visitors' browsers. An attacker who can enter content can run script in the context of other users, including site administrators.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","the-events-calendar","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Script runs in other users' browsers, including administrators' sessions","analyst_note":"Check the NVD entry and the plugin changelog for the fixed version and the required privilege level.","how_to_check":"- Check the installed The Events Calendar plugin version in the WordPress admin Plugins screen\n- Compare the installed version against `6.18.2` and earlier releases listed as affected\n- unknown for further detail","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running The Events Calendar plugin at version 6.18.2 or earlier are affected. Stored XSS requires that an attacker can submit content that the plugin saves and later renders to other users; the sources do not state which roles or settings are needed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00069,"input_tokens":4130,"output_tokens":555,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119369':13A,16A '-2026':12A,15A '6.18.2':10A,103C 'administr':67B 'affect':96C 'allow':92C 'attack':51B 'browser':49B 'calendar':3A,24B,28B,87C,91C,99C 'content':55B 'context':61B 'cross':38B,77C 'cross-sit':37B,76C 'cve':11A,14A 'enter':54B 'event':2A,23B,27B,86C,90C,98C 'generat':75C 'host':20B 'improp':68C 'includ':65B 'input':71C 'issu':95C 'later':45B 'let':35B 'liquid':31B,82C 'n/a':101C 'neutral':69C 'packag':17B 'page':74C 'payload':41B 'plugin':5A,29B 'run':46B,57B 'save':43B 'script':40B,58B,79C 'self':19B 'self-host':18B 'site':39B,66B,78C 'stellarwp':34B,84C 'store':6A,36B,93C 'the-events-calendar':21B,88C 'user':64B 'version':9A 'visitor':48B 'vulner':80C 'web':32B,73C,83C 'wordpress':4A,25B 'xss':7A 'xss.this':94C","nicknames":[],"mitigations":[],"who_affected":"Sites running The Events Calendar plugin at version 6.18.2 or earlier are affected. Stored XSS requires that an attacker can submit content that the plugin saves and later renders to other users; the sources do not state which roles or settings are needed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T16:17:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119369","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119369","severity":null,"published_at":"2026-10-30T16:17:43+00:00","modified_at":"2026-10-30T16:17:43+00:00","first_seen_at":"2026-10-30T16:31:25+00:00","fetched_at":"2026-10-30T16:31:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}