EUVD-2026-42852
GHSA-x463-v9cq-m85h
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-accessible unauthenticated AJAX endpoint (AV:N, PR:N); no complexity barriers; user click required (UI:R); injected script executes in victim browser context, changing scope (S:C) with limited session/content impact (C:L/I:L).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The ICS Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'htmltagtitle' parameter in all versions up to, and including, 12.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability is reachable via the unauthenticated wp_ajax_nopriv_r34ics_ajax AJAX action, which accepts attacker-controlled js_args values merged over stored shortcode configuration without nonce verification, allowing the htmltagtitle key to bypass the normal shortcode allowlist check.
AnalysisAI
Reflected XSS in the ICS Calendar WordPress plugin (all versions ≤ 12.0.9) allows unauthenticated network attackers to inject arbitrary JavaScript into victim browsers by exploiting a missing nonce check and input sanitization failure on the publicly accessible wp_ajax_nopriv_r34ics_ajax AJAX endpoint. The attacker-controlled js_args object is merged over stored shortcode configuration before allowlist validation, enabling the htmltagtitle key to reach the calendar-month.php template unescaped. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The ICS Calendar plugin must be installed and activated on the target WordPress site at version 12.0.9 or earlier - no special plugin configuration or feature enablement is required beyond installation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.1 score reflects medium severity driven by AV:N/AC:L/PR:N (low exploitation barrier - network-reachable, no complexity, no authentication) offset by UI:R (mandatory user interaction) and limited C:L/I:L impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a WordPress site running ICS Calendar ≤ 12.0.9, crafts a URL pointing to the site's wp-admin/admin-ajax.php endpoint with action=r34ics_ajax and a js_args payload containing a malicious htmltagtitle value embedding a JavaScript cookie-stealer. The attacker sends this link to a site administrator via phishing email; when the administrator clicks the link, their browser renders the crafted calendar response and the injected script transmits their WordPress authentication cookies to the attacker's collection server, enabling full admin session hijacking. … |
| Remediation | Update the ICS Calendar plugin to the version released after the patch commit recorded in the WordPress Subversion repository changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3563728%40ics-calendar&new=3563728%40ics-calendar; the exact patched release version number is not independently confirmed from the available data, so administrators should check the WordPress.org plugin directory for the current release and upgrade accordingly. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ics Calendar
View allSame weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today