Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Events Listing Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Event URL' parameter in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-1252 The Events Listing Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Event URL' parameter in all versions up to, and including, 1.3.4 du… https://www.cve.org/CVERecord?id=CVE-2026-1252
Post summary
The Events Listing Widget plugin for WordPress (up to 1.3.4) has a stored XSS flaw in the Event URL parameter, as identified by CVE‑2026‑1252.
CVE-2026-1252 Stored XSS in WordPress Events Listing Widget Plugin via E... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-1252 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2
Post summary
A tweet announcing CVE-2026-1252, a stored XSS vulnerability in the WordPress Events Listing Widget Plugin, with a link to a details page but no PoC, exploit, or mitigation information.