EUVD-2026-43430Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Reflected XSS needs no attacker auth (PR:N) but requires the victim to click a link (UI:R); scope changes to the WordPress app (S:C) with limited C/I/A impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
2DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Room 34 Creative Services, LLC ICS Calendar ics-calendar allows Reflected XSS.This issue affects ICS Calendar: from n/a through <= 12.1.1.
AnalysisAI
Reflected cross-site scripting in the ICS Calendar WordPress plugin (by Room 34 Creative Services) affects all versions from initial release through 12.1.1, letting an attacker craft a malicious URL that, when opened by a victim, injects arbitrary script into the rendered page. Because the CVSS scope is changed (S:C), successful execution can affect resources beyond the vulnerable component, including a logged-in administrator's WordPress session. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to open an attacker-crafted URL targeting the ICS Calendar plugin (UI:R in the CVSS vector) - it is not a silent, no-interaction attack. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score is 7.1 (High) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L: network-reachable, low complexity, no privileges required, but crucially requiring user interaction (UI:R) - the victim must click a crafted link. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a URL to a page that invokes the ICS Calendar plugin with a malicious script embedded in a reflected parameter, then delivers it to a logged-in WordPress administrator via phishing email or a comment link. When the admin opens the link, the script executes in their browser under the site's origin, allowing the attacker to steal session cookies or perform actions as that administrator. … |
| Remediation | Upgrade the ICS Calendar plugin to the first release above 12.1.1 as published on the WordPress plugin repository; the available data confirms all versions through 12.1.1 are vulnerable but does not state an exact patched version number, so treat this as patch available per vendor/Patchstack advisory and verify the fixed release before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all WordPress installations running ICS Calendar plugin versions ≤12.1.1 and immediately disable the plugin or restrict network access to affected administrator pages; review WordPress access logs for unauthorized administrator login patterns and session anomalies. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ics Calendar
View allSame weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today