{"id":"CVE-2026-123469","kind":"vulnerability","aliases":["CVE-2026-123469"],"related":[],"title":"The Events Calendar WordPress plugin: stored script injection via event pages","description":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Code Injection.This issue affects The Events Calendar: from n/a through 6.18.3.","summary":"The Events Calendar, a WordPress plugin from Liquid Web and StellarWP, fails to neutralize script-related HTML tags in a web page, a cross-site scripting flaw. An attacker can inject code that runs in another visitor's browser.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["runtime","self-hosted","the-events-calendar","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of The Events Calendar in the WordPress admin plugin list, or `wp plugin get the-events-calendar --field=version`\n- Compare the version against the range the sources give: from n/a through 6.18.3","fix":null,"status":"open","published_at":"2026-11-07T10:17:11+00:00","first_seen_at":"2026-11-07T10:46:41+00:00","triaged_at":"2026-11-07T10:48:40+00:00","updated_at":"2026-11-07T10:48:40+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-07T10:48:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"The Events Calendar WordPress plugin: stored script injection via event pages","impact":"medium","summary":"The Events Calendar, a WordPress plugin from Liquid Web and StellarWP, fails to neutralize script-related HTML tags in a web page, a cross-site scripting flaw. An attacker can inject code that runs in another visitor's browser.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wordpress","the-events-calendar","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker script runs in visitors' browsers on the site.","analyst_note":"Check the NVD entry and the vendor changelog for the fixed version and whether authentication or a specific feature is required.","how_to_check":"- Check the installed version of The Events Calendar in the WordPress admin plugin list, or `wp plugin get the-events-calendar --field=version`\n- Compare the version against the range the sources give: from n/a through 6.18.3","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running The Events Calendar at version 6.18.3 or earlier. The sources do not say which input or role is needed to trigger the injection, so unknown. Sites without the plugin installed are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000685,"input_tokens":4235,"output_tokens":523,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123469':14A,17A '-2026':13A,16A '6.18.3':105C 'affect':98C 'allow':94C 'anoth':64B 'attack':57B 'basic':80C 'browser':67B 'calendar':3A,25B,29B,89C,93C,101C 'code':60B,95C 'cross':52B 'cross-sit':51B 'cve':12A,15A 'event':2A,10A,24B,28B,88C,92C,100C 'fail':38B 'flaw':55B 'host':21B 'html':44B,74C 'improp':68C 'inject':8A,59B 'injection.this':96C 'issu':97C 'liquid':34B,84C 'n/a':103C 'neutral':40B,69C 'page':11A,49B,79C 'plugin':5A,32B 'relat':43B,73C 'run':62B 'runtim':18B 'script':7A,42B,54B,72C 'script-rel':41B,71C 'self':20B 'self-host':19B 'site':53B 'stellarwp':37B,86C 'store':6A 'tag':45B,75C 'the-events-calendar':22B,90C 'via':9A 'visitor':65B 'vulner':82C 'web':35B,48B,78C,85C 'wordpress':4A,26B,31B 'xss':81C","nicknames":[],"mitigations":[],"who_affected":"Sites running The Events Calendar at version 6.18.3 or earlier. The sources do not say which input or role is needed to trigger the injection, so unknown. Sites without the plugin installed are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","runtime","selfhosted","theeventscalendar","wordpress"],"campaign_type":null,"search_a":"'-123469':14A,17A '-2026':13A,16A 'calendar':3A 'cve':12A,15A 'event':2A,10A 'inject':8A 'page':11A 'plugin':5A 'script':7A 'store':6A 'via':9A 'wordpress':4A","search_b":"'anoth':64B 'attack':57B 'browser':67B 'calendar':25B,29B 'code':60B 'cross':52B 'cross-sit':51B 'event':24B,28B 'fail':38B 'flaw':55B 'host':21B 'html':44B 'inject':59B 'liquid':34B 'neutral':40B 'page':49B 'plugin':32B 'relat':43B 'run':62B 'runtim':18B 'script':42B,54B 'script-rel':41B 'self':20B 'self-host':19B 'site':53B 'stellarwp':37B 'tag':45B 'the-events-calendar':22B 'visitor':65B 'web':35B,48B 'wordpress':26B,31B","search_c":"'6.18.3':105C 'affect':98C 'allow':94C 'basic':80C 'calendar':89C,93C,101C 'code':95C 'event':88C,92C,100C 'html':74C 'improp':68C 'injection.this':96C 'issu':97C 'liquid':84C 'n/a':103C 'neutral':69C 'page':79C 'relat':73C 'script':72C 'script-rel':71C 'stellarwp':86C 'tag':75C 'the-events-calendar':90C 'vulner':82C 'web':78C,85C 'xss':81C","first_public_at":"2026-11-07T10:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123469","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123469","severity":null,"published_at":"2026-11-07T10:17:11+00:00","modified_at":"2026-11-07T10:17:12+00:00","first_seen_at":"2026-11-07T10:46:41+00:00","fetched_at":"2026-11-07T10:46:41+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}