The Events Calendar EUVD-2026-102864

Requires an attacker to hold an authenticated WordPress account with sufficient privileges to create or edit The Events Calendar content (PR:L - typically contributor/author/editor-level event creation), and requires a second user (such as an administrator) to view the page containing the stored payload (UI:R). Exploitation is thus gated by: (1) the attacker obtaining a low-privilege account on the target WordPress site, and (2) victim interaction by rendering the affected event view. It affects The Events Calendar versions from an unspecified start through 6.18.1; sites that restrict event-authoring roles to trusted users materially reduce exposure.

This is a moderate-severity stored XSS (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) in The Events Calendar WordPress plugin, reported by Patchstack. The signals are internally consistent and point to a genuine-but-not-urgent issue rather than a top-priority emergency. The network attack vector (AV:N) and low complexity (AC:L) are offset by two real constraints: the attacker must already hold a low-privilege authenticated account (PR:L) and a victim must interact by viewing the poisoned page (UI:R). The scope change (S:C) reflects the typical XSS pattern where injected script executes in another user's browser session, with low confidentiality/integrity/availability impact (C:L/I:L/A:L) rather than full account takeover in the base metrics. No EPSS probability, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this contrasts with the low but non-trivial inherent exploitability of stored XSS in a widely installed plugin. Net: patch in normal cycles; it is not a high-CVSS-but-illusory issue, but neither is it confirmed-exploited emergency material.

An attacker with a low-privilege authenticated account (e.g., a contributor or author able to create or edit events) stores a malicious script payload in an event field that is rendered without proper output encoding. When an administrator or another logged-in user later views that event in the dashboard or on the front end, the script executes in their browser session, enabling session/cookie theft or actions on their behalf. No public exploit code is identified at time of analysis.