CVE-2026-123464
📛 CVE Title
WordPress The Events Calendar plugin <= 6.18.3 - Cross Site Scripting (XSS) vulnerability
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through 6.18.3.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- Patchstack
- CVSS severity
- MEDIUM
- CVSS score
- 6.5 / 10
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L- Effective score
- 6.5 / 10 MEDIUM source: CNA overview
- CWE(s)
-
CWE-79 - Reserved
- 2026-11-06
- Published
- 2026-11-07 09:15 UTC
- Last updated
- 2026-11-07 18:06 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123464.json
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-119029
EUVD enrichment is queued; refresh the page in a few seconds.
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Liquid Web / StellarWP | The Events Calendar |
0 (affected)
|
— |
Vendor references (1)
References embedded in the original CVE record by the assigning CNA.
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
Remediations (10)
-
web:access.redhat.com
Access Red Hat's knowledge, guidance, and support through your subscription.
2026-11-08 11:33 UTC -
web:cyberupdates365.com
Track critical CVE vulnerabilities 2026 with verified enterprise patch guides. Fix zero-days across VMware, WordPress, Windows, and cloud infrastructure.
2026-11-08 11:33 UTC -
web:endpointweekly.com
All 633 CVEs from September 2026 Patch Tuesday — searchable, filterable, with plain-English IT admin notes on every vulnerability. Includes CVE - 2026 -81963, the exploited Windows Update Stack EoP, and the five CVEs KB5124008 does not fix .
2026-11-08 11:33 UTC -
web:radar.offseq.com
CVE-2026-123464 is a stored cross-site scripting (XSS) vulnerability in The Events Calendar plugin by Liquid Web / StellarWP. The flaw allows improper neutralization of input during web page generation, affecting versions from initial releases up to 6.18.3.
2026-11-08 11:33 UTC -
web:sec.cloudapps.cisco.com
On October 7, 2026 , the Cisco Product Security Incident Response Team (PSIRT) published the advisories that are listed in the following tables. To remediate the vulnerabilities that were disclosed on October 7, 2026 , Cisco strongly recommends that customers upgrade to the fixed software that is indicated in the advisories. For more information about changes in Cisco PSIRT vulnerability ...
2026-11-08 11:33 UTC -
web:senserva.com
KB5126646 is a Critical security update for Windows Server 2025, released 2026 -10-13. It closes 1041 CVEs with a maximum CVSS of 9.8. At least one of them is actively exploited (CISA KEV), so it is urgent, and Microsoft lists 2 known issues and 1 change that might affect your environment: test it before broad deployment. The most likely of them to be attacked is CVE - 2026 -96951, which FIRST.org ...
2026-11-08 11:33 UTC -
web:support.esri.com
This patch deals specifically with the issues listed below under Issues addressed with this patch . As part of the patch installation, the ArcGIS Server service is stopped and restarted. The restart may take several minutes depending on the number of services published on the ArcGIS Server site. This patch can be uninstalled as outlined in the Uninstalling this patch on Windows and Uninstalling ...
2026-11-08 11:33 UTC -
web:support.esri.com
The issues resolved by these patches are listed in the Issues addressed with this patch section below. As part of the patch installation, the ArcGIS Server service is stopped and restarted. The restart may take several minutes depending on the number of services published on the ArcGIS Server site. This patch can be uninstalled as outlined in the Uninstalling this patch on Windows and ...
2026-11-08 11:33 UTC -
web:windowsforum.com
A Windows cumulative update doesn't fix this. Windows Latest warns that installing Windows 11's October 2026 update doesn't necessarily protect you, because Paint is maintained through the Microsoft Store and the app has to be updated separately.
2026-11-08 11:33 UTC -
web:www.tenable.com
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through 6.18.3.
2026-11-08 11:33 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-123464.json.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-123464",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-07T18:00:55.734439Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T18:06:04.148Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "the-events-calendar",
"product": "The Events Calendar",
"vendor": "Liquid Web / StellarWP",
"versions": [
{
"changes": [
{
"at": "6.18.3.1",
"status": "unaffected"
}
],
"lessThanOrEqual": "6.18.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Hatim Madmoune -DELTA | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-11-07T09:15:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.<p>This issue affects The Events Calendar: from n/a through 6.18.3.</p>"
}
],
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through 6.18.3."
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "Stored XSS"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T09:15:20.726Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/the-events-calendar/vulnerability/wordpress-the-events-calendar-plugin-6-18-3-cross-site-scripting-xss-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress The Events Calendar plugin to the latest available version (at least 6.18.3.1)."
}
],
"value": "Update the WordPress The Events Calendar plugin to the latest available version (at least 6.18.3.1)."
}
],
"tags": [
"x_open-source"
],
"title": "WordPress The Events Calendar plugin <= 6.18.3 - Cross Site Scripting (XSS) vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-123464",
"datePublished": "2026-11-07T09:15:20.726Z",
"dateReserved": "2026-11-06T00:25:34.012Z",
"dateUpdated": "2026-11-07T18:06:04.148Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}