CVE-2026-1922

🗓️ 10 Feb 2026 09:26:05Reported by WordfenceType

Authenticated contributors can trigger stored cross site scripting via the ecs-list-events shortcode message attribute in The Events Calendar Shortcode & Block up to version 3.1.2.

Reporter	Title	Published	Views	Family All 9
ATTACKERKB	CVE-2026-1922	10 Feb 202609:26	–	attackerkb
CNNVD	WordPress plugin The Events Calendar Shortcode & Block 跨站脚本漏洞	10 Feb 202600:00	–	cnnvd
Cvelist	CVE-2026-1922 The Events Calendar Shortcode & Block <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	10 Feb 202609:26	–	cvelist
NVD	CVE-2026-1922	10 Feb 202610:15	–	nvd
Patchstack	WordPress The Events Calendar Shortcode & Block plugin <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes vulnerability	9 Feb 202623:43	–	patchstack
Positive Technologies	PT-2026-7247	10 Feb 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-1922	11 Feb 202613:16	–	redhatcve
Vulnrichment	CVE-2026-1922 The Events Calendar Shortcode & Block <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	10 Feb 202609:26	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (February 9, 2026 to February 15, 2026)	19 Feb 202618:42	–	wordfence

Vulners

Node

brianhogg the_events_calendar_shortcode_&_blockRange≤3.1.2wordpress

[
  {
    "vendor": "brianhogg",
    "product": "The Events Calendar Shortcode & Block",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "3.1.2",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset
plugins	www.plugins.trac.wordpress.org/browser/the-events-calendar-shortcode/trunk/the-events-calendar-shortcode.php
plugins	www.plugins.trac.wordpress.org/browser/the-events-calendar-shortcode/tags/3.1.1/the-events-calendar-shortcode.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/bb302539-97e7-4b2c-865d-bd81919647ae

15 Apr 2026 00:35Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.16.4

EPSS0.00015

SSVC

CWE-79