CVE-2024-12118 is a stored cross-site scripting vulnerability in the The Events Calendar WordPress plugin (up to version 6.9.0). It occurs due to improper neutralization of input in the html_tag attribute of the Event Calendar Link Widget, allowing authenticated attackers with Contributor-level privileges or above to inject arbitrary web scripts. These scripts execute in the context of users who access the injected pages, potentially leading to information disclosure or session hijacking. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.4 (medium severity).

An attacker with Contributor-level or higher access can exploit this vulnerability to inject malicious scripts that execute in the browsers of users viewing the affected pages. This can lead to limited confidentiality and integrity impacts, such as theft of user session data or unauthorized actions performed on behalf of users. There is no indication of availability impact. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or limiting use of the Event Calendar Link Widget. Monitor vendor channels for updates and apply patches promptly once released.