Events Shortcodes & Templates For The Events Calendar <= 2.8.4 - Authenticated (Author+) Stored Cross-Site Scripting via Event Category Name
- ID
- WPSEC-2026-2535
- Plugin
- Events Shortcodes For The Events Calendar (template-events-calendar)
- Affected
- from 2.8.0 before 3.0.0
- Remediation
- Update to 3.0.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-05
- Attack surface
- Events Shortcodes & Templates For The Events Calendar on WPSec AttackSurface
- Fix released
- Published
Description
The Events Shortcodes For The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event category names in all versions up to, and including, 2.8.4, due to the onboarding wizard's category multiselect script reading category labels as decoded text and writing them back into the page with innerHTML, without escaping. This makes it possible for authenticated attackers with author-level access and above, who can manage The Events Calendar's event categories by default, to inject arbitrary web scripts into an event category name. The scripts run in an administrator's browser when the administrator selects that category in the plugin's Getting Started wizard.
References
- https://wpsec.com/vuln/WPSEC-2026-2535/
- https://plugins.svn.wordpress.org/template-events-calendar/tags/3.0.0/
- https://wordpress.org/plugins/template-events-calendar/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS