{"id":"CVE-2026-123464","kind":"vulnerability","aliases":["CVE-2026-123464"],"related":[],"title":"The Events Calendar WordPress plugin: stored XSS through 6.18.3","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through 6.18.3.","summary":"The Events Calendar plugin by Liquid Web and StellarWP lets stored script be saved and later run in a visitor's browser. An attacker who can enter event content could run JavaScript in the browser of anyone who views the affected page.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","the-events-calendar","wordpress"],"not_affected_if":["plugin-not-installed","version-above-6.18.3"],"how_to_check":"- Check the installed The Events Calendar plugin version in the WordPress admin under Plugins; versions through `6.18.3` are listed as affected.","fix":"- The Events Calendar: a version later than `6.18.3` (the sources do not name the exact fixed release).","status":"open","published_at":"2026-11-07T10:17:11+00:00","first_seen_at":"2026-11-07T10:46:41+00:00","triaged_at":"2026-11-07T10:48:28+00:00","updated_at":"2026-11-07T10:48:28+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-07T10:48:28Z","model":"claude-haiku-5-5","output":{"fix":"- The Events Calendar: a version later than `6.18.3` (the sources do not name the exact fixed release).","reach":"internet","title":"The Events Calendar WordPress plugin: stored XSS through 6.18.3","impact":"medium","summary":"The Events Calendar plugin by Liquid Web and StellarWP lets stored script be saved and later run in a visitor's browser. An attacker who can enter event content could run JavaScript in the browser of anyone who views the affected page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","the-events-calendar","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker script runs in visitors' browsers on the site.","analyst_note":"Confirm the fixed version and the minimum role needed to store the payload from the vendor advisory or the NVD entry.","how_to_check":"- Check the installed The Events Calendar plugin version in the WordPress admin under Plugins; versions through `6.18.3` are listed as affected.\n- Unknown whether a stored-XSS payload has already been saved; the sources do not say how to check the database.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-above-6.18.3"],"who_is_affected":"Sites running The Events Calendar plugin at version 6.18.3 or earlier. The sources do not describe which roles can submit the stored content, so exposure depends on who can enter event data on the site.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000706,"input_tokens":4230,"output_tokens":566,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123464':12A,15A '-2026':11A,14A '6.18.3':9A,102C 'affect':65B,95C 'allow':91C 'anyon':61B 'attack':48B 'browser':46B,59B 'calendar':3A,23B,27B,86C,90C,98C 'content':53B 'could':54B 'cross':76C 'cross-sit':75C 'cve':10A,13A 'enter':51B 'event':2A,22B,26B,52B,85C,89C,97C 'generat':74C 'host':19B 'improp':67C 'input':70C 'issu':94C 'javascript':56B 'later':40B 'let':34B 'liquid':30B,81C 'n/a':100C 'neutral':68C 'packag':16B 'page':66B,73C 'plugin':5A,28B 'run':41B,55B 'save':38B 'script':36B,78C 'self':18B 'self-host':17B 'site':77C 'stellarwp':33B,83C 'store':6A,35B,92C 'the-events-calendar':20B,87C 'view':63B 'visitor':44B 'vulner':79C 'web':31B,72C,82C 'wordpress':4A,24B 'xss':7A 'xss.this':93C","nicknames":[],"mitigations":[],"who_affected":"Sites running The Events Calendar plugin at version 6.18.3 or earlier. The sources do not describe which roles can submit the stored content, so exposure depends on who can enter event data on the site.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","theeventscalendar","wordpress"],"campaign_type":null,"search_a":"'-123464':12A,15A '-2026':11A,14A '6.18.3':9A 'calendar':3A 'cve':10A,13A 'event':2A 'plugin':5A 'store':6A 'wordpress':4A 'xss':7A","search_b":"'affect':65B 'anyon':61B 'attack':48B 'browser':46B,59B 'calendar':23B,27B 'content':53B 'could':54B 'enter':51B 'event':22B,26B,52B 'host':19B 'javascript':56B 'later':40B 'let':34B 'liquid':30B 'packag':16B 'page':66B 'plugin':28B 'run':41B,55B 'save':38B 'script':36B 'self':18B 'self-host':17B 'stellarwp':33B 'store':35B 'the-events-calendar':20B 'view':63B 'visitor':44B 'web':31B 'wordpress':24B","search_c":"'6.18.3':102C 'affect':95C 'allow':91C 'calendar':86C,90C,98C 'cross':76C 'cross-sit':75C 'event':85C,89C,97C 'generat':74C 'improp':67C 'input':70C 'issu':94C 'liquid':81C 'n/a':100C 'neutral':68C 'page':73C 'script':78C 'site':77C 'stellarwp':83C 'store':92C 'the-events-calendar':87C 'vulner':79C 'web':72C,82C 'xss.this':93C","first_public_at":"2026-11-07T10:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123464","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123464","severity":null,"published_at":"2026-11-07T10:17:11+00:00","modified_at":"2026-11-07T10:17:11+00:00","first_seen_at":"2026-11-07T10:46:41+00:00","fetched_at":"2026-11-07T10:46:41+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}