Events Widgets For Elementor And The Events Calendar <= 1.9.4 - Authenticated (Author+) Stored Cross-Site Scripting via Event Category Name
- ID
- WPSEC-2026-2631
- Plugin
- Events Widgets For Elementor And The Events Calendar (events-widgets-for-elementor-and-the-events-calendar)
- Affected
- from 1.9.0 before 1.9.5
- Remediation
- Update to 1.9.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-06
- Attack surface
- Events Widgets For Elementor And The Events Calendar on WPSec AttackSurface
- Fix released
- Published
Description
The Events Widgets For Elementor And The Events Calendar plugin for WordPress is vulnerable to DOM-based Stored Cross-Site Scripting via event category names in all versions up to, and including, 1.9.4, due to the onboarding wizard's category multiselect reading each term name back as text and inserting it into the page with innerHTML when it renders the selected-category chips. This makes it possible for authenticated attackers with Author-level access and above, who can create event categories by default in The Events Calendar, to inject arbitrary web scripts into a category name, for example as HTML-encoded markup. The scripts run when an administrator opens the plugin's onboarding page and the category is selected.
References
- https://wpsec.com/vuln/WPSEC-2026-2631/
- https://plugins.svn.wordpress.org/events-widgets-for-elementor-and-the-events-calendar/tags/1.9.5/
- https://wordpress.org/plugins/events-widgets-for-elementor-and-the-events-calendar/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS