CVE-2026-110903: WordPress The Events Calendar plugin <= 6.18.1 - Cross Site Scripting (XSS) vulnerability

Q: What level of access and interaction are required to exploit this issue?

The attack vector is network-based, but the CVSS vector indicates that an attacker needs low-level privileges and that user interaction is required. The vulnerability can affect confidentiality, integrity, and availability at a low impact level, with scope changed.

Q: Which plugin versions are affected?

The affected range is The Events Calendar versions through 6.18.1. No fixed version is identified in the provided information.

Published Oct 16, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through 6.18.1.

Affected Software

1 affected component

Stellarwp The Events Calendar<=6.18.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress The Events Calendar plugin to a version that resolves this vulnerability.
Fixed in 6.18.2

Event History

Oct 16, 2026

CVE Published

via MITRE·12:51 PM

Data Sourced

via MITRE·12:51 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What level of access and interaction are required to exploit this issue?

The attack vector is network-based, but the CVSS vector indicates that an attacker needs low-level privileges and that user interaction is required. The vulnerability can affect confidentiality, integrity, and availability at a low impact level, with scope changed.

Which plugin versions are affected?