The vulnerability is an improper neutralization of input that allows a stored XSS attack via the The Events Calendar plugin. A malicious actor can inject arbitrary JavaScript into events, which is executed in the browsers of users visiting the affected pages. This can lead to credential theft, session hijacking, or site defacement. The weakness corresponds to CWE‑79, a classic input‑validation issue.

Any WordPress site that uses Liquid Web / StellarWP’s The Events Calendar plugin, version 6.18.2 or earlier, is affected. The regression started with the first release of the plugin and continues through 6.18.2, so all installations of those or older plugin versions are vulnerable. Site administrators using the default event editorial interface are at risk because values entered in event descriptions or titles are stored without sanitization.

The CVSS score of 6.5 reflects medium severity. No EPSS score is published, so exploitation frequency is unknown. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need the ability to create or edit an event record, which could be restricted to privileged users. Once an event is posted, the injected script runs automatically for any visitor, presenting an opportunity for silent attacks.