The Events Calendar <= 6.18.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Elementor Widget HTML Tag Settings
- ID
- WPSEC-2026-1140
- Plugin
- The Events Calendar (the-events-calendar)
- Affected
- from 6.4.0 before 6.18.2
- Remediation
- Update to 6.18.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-16
- Attack surface
- The Events Calendar on WPSec AttackSurface
- Fix released
- Published
Description
The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML tag settings (such as header_tag and html_tag) of its Elementor widgets in all versions from 6.4.0 up to, and including, 6.18.1, due to insufficient validation of these values. The editor only offers a fixed list of tags, but the server does not enforce it. The templates pass the value through tag_escape(), which removes attribute syntax but still accepts any tag name, such as script. This makes it possible for authenticated attackers, with contributor-level access and above who can edit with Elementor, to wrap content they control (for example an event title) in an executable element and inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
References
- https://wpsec.com/vuln/WPSEC-2026-1140/
- https://plugins.svn.wordpress.org/the-events-calendar/tags/6.18.2/
- https://wordpress.org/plugins/the-events-calendar/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS