# The Events Calendar <= 6.18.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Event Timezone

- **ID:** WPSEC-2026-2147
- **Plugin:** The Events Calendar (`the-events-calendar`), https://wordpress.org/plugins/the-events-calendar/
- **Affected versions:** all versions before 6.18.3
- **Fixed in:** 6.18.3 (Update to 6.18.3 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/the-events-calendar
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2147/

## Description

The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_EventTimezone' event meta value in all versions up to, and including, 6.18.2, due to insufficient input sanitization and output escaping. The timezone was not checked against real timezone identifiers when saved through the REST API or the classic editor, and the event sanitizer removed only one level of entity encoding. The stored value is printed into a data attribute of the classic event editor, and the plugin's script then inserts it into the timezone-change link without escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts that execute whenever a user, such as an administrator reviewing the event, opens the injected event in the classic editor.

## References

- https://wpsec.com/vuln/WPSEC-2026-2147/
- https://plugins.svn.wordpress.org/the-events-calendar/tags/6.18.3/
- https://wordpress.org/plugins/the-events-calendar/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2147/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.