Stored Cross-Site Scripting Vulnerability in WP Event Aggregator Plugin
CVE-2026-1941

6.4MEDIUM

Key Information:

Vendor: WordPress
Status: WP Event Aggregator: Import Eventbrite Events, Meetup Events, Social Events And Any Ical Events Into Event Calendar
Vendor: CVE Published:; 18 February 2026

What is CVE-2026-1941?

The WP Event Aggregator plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) due to inadequate input sanitization and output escaping on user-supplied attributes within its 'wp_events' shortcode. Authenticated individuals with Contributor-level access or higher can exploit this vulnerability to insert arbitrary web scripts into pages that execute whenever a user accesses the compromised page, potentially leading to severe security breaches and unauthorized access.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

WP Event Aggregator: Import Eventbrite events, Meetup events, social events and any iCal Events into Event Calendar * <= 1.8.7

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...

https://plugins.trac.wordpress.org/browser/wp-event-aggre...

CVSS V3.1

Score:

6.4

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Changed

Timeline

Vulnerability published
Feb 18, 2026
Vulnerability Reserved
Feb 4, 2026

Credit

Athiwat Tiprasaharn

Waris Damkham

JSON

WordPress