CVE-2026-110903: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Liquid Web / StellarWP The Events Calendar

This vulnerability in The Events Calendar plugin allows stored cross-site scripting due to improper input neutralization during web page generation. An attacker with low privileges can inject malicious scripts that execute when other users view the affected pages. The flaw affects all versions prior to 6.18.2. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, and impacts confidentiality, integrity, and availability with low to medium severity.

Successful exploitation could lead to execution of arbitrary scripts in the context of the affected web application, potentially allowing attackers to steal user data, perform actions on behalf of users, or disrupt service. The impact is limited by the requirement of user interaction and low privileges, but the vulnerability affects confidentiality, integrity, and availability to some extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or vendor advisory link is provided, users should monitor for updates from Liquid Web / StellarWP and apply the update to version 6.18.2 or later once available. Until then, consider restricting user input or applying web application firewall rules to mitigate stored XSS risks.