CVE-2026-1922
Stored XSS in The Events Calendar Shortcode Plugin Allows Script Injection
Publication date: 2026-02-10
Last updated on: 2026-02-10
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| moderntribe | the_events_calendar_shortcode_and_block | to 3.1.2 (inc) |
| moderntribe | the_events_calendar_shortcode | to 3.1.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in The Events Calendar Shortcode & Block plugin for WordPress, specifically in all versions up to and including 3.1.2. It is a Stored Cross-Site Scripting (XSS) vulnerability that arises because the plugin does not properly sanitize or escape user-supplied input in the `message` attribute of the `ecs-list-events` shortcode.
This flaw allows authenticated users with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts then execute whenever any user accesses the affected page, potentially compromising user data or site integrity.
How can this vulnerability impact me? :
This Stored Cross-Site Scripting vulnerability can have several impacts:
- An attacker with contributor-level access or above can inject malicious scripts into pages via the shortcode's message attribute.
- These malicious scripts execute in the browsers of users who visit the infected pages, potentially leading to theft of cookies, session tokens, or other sensitive information.
- It can also be used to perform actions on behalf of users without their consent, deface the website, or spread malware.
- Because the vulnerability requires authenticated access, it limits exploitation to users who already have some level of access, but still poses a significant risk within multi-user WordPress environments.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate the Stored Cross-Site Scripting vulnerability in The Events Calendar Shortcode & Block plugin for WordPress, you should immediately update the plugin to version 3.1.3 or later.
The update from version 3.1.2 to 3.1.3 includes security improvements that properly sanitize and escape user input in the `message` attribute of the `ecs-list-events` shortcode, preventing arbitrary script injection.
Ensure your WordPress installation and all plugins are kept up to date, and restrict contributor-level access to trusted users only.