# Events Widgets For Elementor And The Events Calendar <= 1.9.4 - Authenticated (Author+) Stored Cross-Site Scripting via Event Category Name

- **ID:** WPSEC-2026-2631
- **Plugin:** Events Widgets For Elementor And The Events Calendar (`events-widgets-for-elementor-and-the-events-calendar`), https://wordpress.org/plugins/events-widgets-for-elementor-and-the-events-calendar/
- **Affected versions:** from 1.9.0 before 1.9.5
- **Fixed in:** 1.9.5 (Update to 1.9.5 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-06)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/events-widgets-for-elementor-and-the-events-calendar
- **Fix released:** 2026-11-05
- **Published:** 2026-11-06
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2631/

## Description

The Events Widgets For Elementor And The Events Calendar plugin for WordPress is vulnerable to DOM-based Stored Cross-Site Scripting via event category names in all versions up to, and including, 1.9.4, due to the onboarding wizard's category multiselect reading each term name back as text and inserting it into the page with innerHTML when it renders the selected-category chips. This makes it possible for authenticated attackers with Author-level access and above, who can create event categories by default in The Events Calendar, to inject arbitrary web scripts into a category name, for example as HTML-encoded markup. The scripts run when an administrator opens the plugin's onboarding page and the category is selected.

## References

- https://wpsec.com/vuln/WPSEC-2026-2631/
- https://plugins.svn.wordpress.org/events-widgets-for-elementor-and-the-events-calendar/tags/1.9.5/
- https://wordpress.org/plugins/events-widgets-for-elementor-and-the-events-calendar/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2631/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.