Skip to content
Sign in
6.5 Medium

CVE-2026-123464 WordPress The Events Calendar plugin <= 6.18.3 - Cross Site Scripting (XSS) vulnerability

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through 6.18.3.

CVSS 3.1 detail

Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Exploitable remotely over the network, with an ordinary account and if a user takes an action; the impact on data or service is limited.

Attack vector
Network
Attack complexity
Low
Privileges required
Low
Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
Low

Affected products and versions

Product Affected versions Fixed in
The Events Calendar 6.18 earliest → 6.18.3 No fix stated

Other CVEs of The Events Calendar

The 9 CVEs of The Events Calendar →
CVE-2026-123469 WordPress The Events Calendar plugin <= 6.18.3 - Content Injection vulnerability 5.3 Medium CVE-2026-119367 Missing Authorization vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows… 5.4 Medium CVE-2026-119369 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web /… 6.5 Medium CVE-2026-119368 Missing Authorization vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows… 5.3 Medium
Track this CVE