Description
The The Events Calendar Shortcode & Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `ecs-list-events` shortcode `message` attribute in all versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2026-02-10
Score: 6.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Stored Cross‑Site Scripting
Action: Upgrade Now
AI Analysis

Impact

The Events Calendar Shortcode & Block plugin for WordPress is vulnerable to a stored Cross‑Site Scripting flaw in the ecs‑list‑events shortcode message attribute. An attacker with contributor‑level or higher privileges can embed arbitrary JavaScript that runs whenever a page containing the injected shortcode is displayed.

Affected Systems

The flaw affects the The Events Calendar Shortcode & Block plugin developed by Brian Hogg, in all versions up to and including 3.1.2.

Risk and Exploitability

The severity score is CVSS 6.4, indicating moderate risk, and the computed EPSS score is less than 1%, suggesting a low probability of exploitation at present. It is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers must first gain authenticated access with at least contributor rights and then supply a crafted shortcode to store the malicious payload.

Generated by OpenCVE AI on April 15, 2026 at 21:17 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the plugin to a version newer than 3.1.2 once it is available.
  • If an upgrade is not possible, restrict contributor‑level users from adding or editing shortcodes, or use a role‑based access plugin to remove the capability to edit content containing shortcodes.
  • As an interim measure, remove or sanitize the ecs‑list‑events shortcode from existing content, or replace it with a manually sanitized version that escapes the message attribute.

Generated by OpenCVE AI on April 15, 2026 at 21:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 10 Feb 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 10 Feb 2026 12:45:00 +0000

Type Values Removed Values Added
First Time appeared Brian Hogg
Brian Hogg the Events Calendar Shortcode & Block
Wordpress
Wordpress wordpress
Vendors & Products Brian Hogg
Brian Hogg the Events Calendar Shortcode & Block
Wordpress
Wordpress wordpress

Tue, 10 Feb 2026 09:45:00 +0000

Type Values Removed Values Added
Description The The Events Calendar Shortcode & Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `ecs-list-events` shortcode `message` attribute in all versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Title The Events Calendar Shortcode & Block <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

Brian Hogg The Events Calendar Shortcode & Block
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T17:18:25.627Z

Reserved: 2026-02-04T18:02:34.066Z

Link: CVE-2026-1922

cve-icon Vulnrichment

Updated: 2026-02-10T16:10:47.501Z

cve-icon NVD

Status : Deferred

Published: 2026-02-10T10:15:57.883

Modified: 2026-04-15T00:35:42.020

Link: CVE-2026-1922

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-15T21:30:13Z

Weaknesses