The Events Calendar <= 6.18.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Event Timezone
- ID
- WPSEC-2026-2147
- Plugin
- The Events Calendar (the-events-calendar)
- Affected
- all versions before 6.18.3
- Remediation
- Update to 6.18.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-30
- Attack surface
- The Events Calendar on WPSec AttackSurface
- Fix released
- Published
Description
The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_EventTimezone' event meta value in all versions up to, and including, 6.18.2, due to insufficient input sanitization and output escaping. The timezone was not checked against real timezone identifiers when saved through the REST API or the classic editor, and the event sanitizer removed only one level of entity encoding. The stored value is printed into a data attribute of the classic event editor, and the plugin's script then inserts it into the timezone-change link without escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts that execute whenever a user, such as an administrator reviewing the event, opens the injected event in the classic editor.
References
- https://wpsec.com/vuln/WPSEC-2026-2147/
- https://plugins.svn.wordpress.org/the-events-calendar/tags/6.18.3/
- https://wordpress.org/plugins/the-events-calendar/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS