Vulnerabilities and security researches forxo-event-calendar xo-event-calendar

Apr 16, 2026

CVE, Research URL: CVE-2026-0556
Home page URL: Security reports for XO Event Calendar
Application: XO Event Calendar
Date: Feb 19, 2026
Research Description: The XO Event Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xo_event_field' shortcode in all versions up to, and including, 3.2.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: max 3.2.10.
Status: vulnerable

Jun 07, 2024

CVE, Research URL: 92562c6c-94a4-427d-97dc-7f5ffddcb6d8
Home page URL: Security reports for XO Event Calendar
Application: XO Event Calendar
Date: -
Research Description: XO Event Calendar [xo-event-calendar] < 2.3.7 (closed) XO Event Calendar < 2.3.7 - Reflected Cross-Site Scripting The plugin does not escape the selected-name parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue
Affected versions: max 2.3.7.
Status: vulnerable