CVE-2026-123464 · Package
NO FIX YET · SEE WHAT TO DO
The Events Calendar plugin by Liquid Web and StellarWP lets stored script be saved and later run in a visitor's browser. An attacker who can enter event content could run JavaScript in the browser of anyone who views the affected page.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running The Events Calendar plugin at version 6.18.3 or earlier. The sources do not describe which roles can submit the stored content, so exposure depends on who can enter event data on the site.
Not affected if plugin-not-installed, version-above-6.18.3
Who cares self-hosted, the-events-calendar, wordpress
6.18.3 are listed as affected.6.18.3 (the sources do not name the exact fixed release).Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through 6.18.3.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.