Is CVE-2026-123469 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-123469 being exploited in the wild.

How severe is CVE-2026-123469?

Medium severity, with a CVSS score of 5.3, published 7 November 2026.

Which products and versions are affected?

StellarWP The Events Calendar 6.18.3 and earlier.

Is there a fix for CVE-2026-123469?

Yes: fixed in 6.18.3.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-123469 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-123469?

Check whether you run StellarWP The Events Calendar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123469: StellarWP The Events Calendar cross-site scripting in content

CVE-2026-123469 · Severity: medium · CVSS 5.3 · Published 2026-11-07

The Events Calendar is a WordPress plugin that manages event listings and calendars on websites. The plugin fails to properly filter user-supplied content, allowing attackers to inject malicious scripts that execute in the browser of site visitors. An attacker can inject malicious ads, phishing content, or malware links that appear legitimate to users.

Technologies: StellarWP The Events Calendar. Vendors: StellarWP.

Quick answers

Is CVE-2026-123469 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-123469 being exploited in the wild.
How severe is CVE-2026-123469?: Medium severity, with a CVSS score of 5.3, published 7 November 2026.
Which products and versions are affected?: StellarWP The Events Calendar 6.18.3 and earlier.
Is there a fix for CVE-2026-123469?: Yes: fixed in 6.18.3.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123469 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-123469?: Check whether you run StellarWP The Events Calendar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 6.18.3.1

Technical details

This is a stored cross-site scripting (XSS) vulnerability caused by improper neutralization of HTML script tags in user-controlled content. The vulnerability affects unauthenticated attackers who can inject content through the plugin; the malicious payload persists and executes when other users view the affected pages. Exploitation requires no user interaction beyond normal site usage.

Affected products

StellarWP The Events Calendar 6.18.3 and earlier

Timeline

2026-10-29: disclosed
2026-11-07: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.