CVE-2026-123464: falha de média gravidade em Liquid Web / StellarWP The Events Calendar
WordPress The Events Calendar plugin <= 6.18.3 - Cross Site Scripting (XSS) vulnerability
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.5epss 0.2%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through 6.18.3.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Produtos afetados
Liquid Web / StellarWP · The Events CalendarCVEs relacionadas — Liquid Web / StellarWP The Events Calendar
No mesmo produto, das mais perigosas para as menos.
CVE-2026-49772CRITICALWordPress The Events Calendar plugin 6.15.12-6.16.2 - SQL Injection vulnerabilityEPSS 1.9%CVE-2026-123469MEDIUMWordPress The Events Calendar plugin <= 6.18.3 - Content Injection vulnerabilityEPSS 0.3%CVE-2026-95606CRITICALWordPress The Events Calendar plugin <= 6.17.4 - PHP Object Injection vulnerabilityEPSS 0.3%CVE-2026-119368MEDIUMWordPress The Events Calendar plugin <= 6.18.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-119367MEDIUMWordPress The Events Calendar plugin <= 6.18.2 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-119369MEDIUMWordPress The Events Calendar plugin <= 6.18.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%