CVE-2026-123464: WordPress The Events Calendar plugin <= 6.18.3 - Cross Site Scripting (XSS) vulnerability

Q: Which plugin versions are identified as affected?

The affected range is stated as The Events Calendar from an unspecified starting version through 6.18.3.

Q: Does the available information identify required attacker permissions, affected plugin features, or a workaround?

No. The provided data identifies the issue as stored XSS but does not specify attacker prerequisites, affected functionality, default-configuration exposure, detection steps, or mitigations.

Published Nov 7, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through 6.18.3.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress The Events Calendar plugin to a version that resolves this vulnerability.
Fixed in 6.18.3.1

Event History

Nov 7, 2026

CVE Published

via MITRE·09:15 AM

Data Sourced

via MITRE·09:15 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which plugin versions are identified as affected?

The affected range is stated as The Events Calendar from an unspecified starting version through 6.18.3.

Does the available information identify required attacker permissions, affected plugin features, or a workaround?

No. The provided data identifies the issue as stored XSS but does not specify attacker prerequisites, affected functionality, default-configuration exposure, detection steps, or mitigations.

CVE-2026-123464: WordPress The Events Calendar plugin <= 6.18.3 - Cross Site Scripting (XSS) vulnerability

Remediation

Event History

Frequently Asked Questions

Which plugin versions are identified as affected?

Does the available information identify required attacker permissions, affected plugin features, or a workaround?

Company

Resources

Contact

Frequently Asked Questions

Which plugin versions are identified as affected?

Does the available information identify required attacker permissions, affected plugin features, or a workaround?