The Events Calendar CVE-2026-119369

Exploitation requires an authenticated account with at least low-level privileges (PR:L) capable of submitting content that The Events Calendar stores and renders, plus subsequent interaction by a victim who loads the affected page (UI:R) for the stored script to fire. The specific input field, event parameter, or plugin feature that fails to neutralize the payload is not described in the available sources. Limiting factors that reduce real-world risk: the attacker cannot be fully anonymous (an account is needed), exploitation depends on a second user viewing the injected content, and impact is bounded to Low confidentiality/integrity/availability rather than direct code execution; all affected versions are those from an unspecified start through 6.18.2.

This is a mid-severity (CVSS 6.5) stored cross-site scripting flaw whose real-world priority sits below the top tier. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) indicates network-reachable, low-complexity exploitation but requires an authenticated low-privileged account (PR:L) and victim interaction (UI:R), with a scope change (S:C) reflecting that injected script executes in another user's browser context. There is no CISA KEV listing and no EPSS score supplied, so widespread or active exploitation cannot be asserted; exploitation status is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month', consistent with a real but non-emergency issue: it should be patched on a routine-but-prompt cycle rather than treated as an active-exploitation fire drill. The impact triad is only Low across C/I/A, which is typical for reflected session/token theft or defacement via stored XSS rather than full system compromise. No EPSS, KEV, SSVC automatable/technical-impact fields, or confirmed working PoC were provided - this absence is noted, not treated as evidence of safety.

An attacker holding a low-privileged authenticated account on the WordPress site (e.g., a contributor or author able to create or edit event content) submits an event or input field containing a malicious script payload that is stored by The Events Calendar. When an administrator or another user later views the affected page, the stored script executes in their browser, enabling session/cookie theft or actions in their context. No verified working exploit code was provided in the input; only a Patchstack vulnerability database entry is referenced.