# The Events Calendar <= 6.18.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Elementor Widget HTML Tag Settings

- **ID:** WPSEC-2026-1140
- **Plugin:** The Events Calendar (`the-events-calendar`), https://wordpress.org/plugins/the-events-calendar/
- **Affected versions:** from 6.4.0 before 6.18.2
- **Fixed in:** 6.18.2 (Update to 6.18.2 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/the-events-calendar
- **Fix released:** 2026-10-15
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1140/

## Description

The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML tag settings (such as header_tag and html_tag) of its Elementor widgets in all versions from 6.4.0 up to, and including, 6.18.1, due to insufficient validation of these values. The editor only offers a fixed list of tags, but the server does not enforce it. The templates pass the value through tag_escape(), which removes attribute syntax but still accepts any tag name, such as script. This makes it possible for authenticated attackers, with contributor-level access and above who can edit with Elementor, to wrap content they control (for example an event title) in an executable element and inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

## References

- https://wpsec.com/vuln/WPSEC-2026-1140/
- https://plugins.svn.wordpress.org/the-events-calendar/tags/6.18.2/
- https://wordpress.org/plugins/the-events-calendar/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1140/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.