The Events Calendar CVE-2026-119370

Exploitation requires an authenticated account with at least low-privilege posting capability on the WordPress site (CVSS PR:L), because the attacker must store the payload through an input field processed by The Events Calendar plugin; the specific injection parameter and feature are not identified in the available sources. Execution additionally requires a victim to view the page containing the stored payload (UI:R), typically a higher-privileged user such as an administrator, and the impact crosses into that victim's browser context (scope change, S:C). Limiting factors: the attacker cannot act fully unauthenticated, impact is realized only upon victim page rendering, and the plugin must be installed at a vulnerable version (through 6.18.2). No fixed version is stated in the available data, so updating to a vendor-patched release should be verified directly with Patchstack/StellarWP.

This is a moderate-severity stored XSS (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) in a very widely deployed WordPress plugin, but the available signals point to a managed, non-emergency priority rather than an acute threat. The CVSS vector confirms network vector and low complexity but also requires authenticated access (PR:L) and victim interaction (UI:R), which materially constrains real-world exploitation. The vuln.today decision label is 'this_month' (not act_now/emergency), and there is no EPSS score, no CISA KEV listing, and no confirmed public exploit code in the input - only a single Patchstack database advisory, which is the discoverer's catalog entry, not verified working exploit code. The signals are internally consistent (authenticated stored XSS, scope change to other users' browsers, limited C/I/A impact) with no contradictions, so this reads as a genuine but routine patch-cycle issue, not a high-CVSS-but-illusory one. The main caveat is missing exploitation-probability telemetry (no EPSS/KEV), so prioritization should lean on the scoped impact and the plugin's large footprint rather than on confirmed attacker activity.

An attacker holding a low-privileged authenticated role (e.g., contributor/author) on the WordPress site injects a malicious script payload through an input field handled by The Events Calendar that is stored and later rendered without proper neutralization. When a higher-privileged user such as an administrator views the affected page in the dashboard or front end, the stored script executes in their browser session (scope change), enabling session/credential theft or admin actions on their behalf. No verified public exploit code is provided - only a Patchstack advisory reference - and exploitation depends on the victim viewing the tainted content (UI:R).