{
 "id": "WPSEC-2026-2535",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2535/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2535/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2535/index.md",
 "title": "Events Shortcodes & Templates For The Events Calendar <= 2.8.4 - Authenticated (Author+) Stored Cross-Site Scripting via Event Category Name",
 "description": "The Events Shortcodes For The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event category names in all versions up to, and including, 2.8.4, due to the onboarding wizard's category multiselect script reading category labels as decoded text and writing them back into the page with innerHTML, without escaping. This makes it possible for authenticated attackers with author-level access and above, who can manage The Events Calendar's event categories by default, to inject arbitrary web scripts into an event category name. The scripts run in an administrator's browser when the administrator selects that category in the plugin's Getting Started wizard.",
 "plugin": {
  "slug": "template-events-calendar",
  "name": "Events Shortcodes & Templates For The Events Calendar",
  "full_name": "Events Shortcodes For The Events Calendar",
  "wordpress_org": "https://wordpress.org/plugins/template-events-calendar/",
  "advisories_url": "https://wpsec.com/vuln/plugin/template-events-calendar/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/template-events-calendar"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.8.0",
    "from_inclusive": true,
    "to": "3.0.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.8.0 before 3.0.0"
  ]
 },
 "introduced_in": "2.8.0",
 "fixed_in": "3.0.0",
 "remediation": "Update to 3.0.0 or later.",
 "fix_released": "2026-11-04T05:10:39+00:00",
 "published": "2026-11-05T05:42:12+00:00",
 "updated": "2026-11-04T13:58:08.239314+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2535/",
  "https://plugins.svn.wordpress.org/template-events-calendar/tags/3.0.0/",
  "https://wordpress.org/plugins/template-events-calendar/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/template-events-calendar",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-05"
 }
}