What is the CVSS score of EUVD-2026-43124?

EUVD-2026-43124 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Lockme Calendars Integration EUVD-2026-43124

| CVE-2026-3367 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-11 Wordfence

GHSA-6q4h-2q4c-jmg7

WordPress XSS Wordpress Plugin Lockme Calendars Integration

4.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

4.0 MEDIUM

Changed UI:N to UI:R because scope-changed impact requires a second user (victim admin) to navigate to the settings page for the XSS payload to fire against them.

3.1 AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 11, 2026 - 03:56 vuln.today

CVE Published

Jul 11, 2026 - 02:31 cve.org

MEDIUM 4.4

DescriptionCVE.org

The Lockme OAuth2 calendars integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'App ID' setting in all versions up to, and including, 2.11.0. This is due to insufficient input sanitization and output escaping. The register_setting() call on line 197 lacks a sanitize callback, allowing unsanitized data to be stored via update_option(). When the settings page is rendered, the stored value is echoed directly into an HTML input's value attribute without esc_attr() on line 212. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in the settings page that will execute whenever a user accesses the plugin settings page. Multiple fields are affected: App ID (client_id), App Secret (client_secret), Bookings ID prefix (id_prefix), and API domain (api_domain). This vulnerability is particularly impactful in WordPress multisite installations where administrators of individual sites should not be able to execute JavaScript affecting other users.

AnalysisAI

Stored Cross-Site Scripting in the Lockme OAuth2 Calendars Integration WordPress plugin (all versions through 2.11.0) permits authenticated administrators to persist arbitrary JavaScript in four settings fields - App ID, App Secret, Bookings ID prefix, and API domain - which then executes in the browser of any user who loads the plugin settings page. The root cause is a missing sanitize callback in register_setting() (Plugin.php:197) paired with unescaped output via direct echo into an HTML value attribute without esc_attr() (lines 212, 223, 245, 256), a classic CWE-79 dual-failure pattern. Exploitation risk is highest in WordPress multisite environments where per-site administrators, who should not have cross-site authority, could poison settings to harvest session tokens or perform actions in the context of super-administrators. No public exploit code and no CISA KEV listing have been identified at time of analysis; an upstream patch changeset (revision 3495564) has been committed to the WordPress plugin repository.

Technical ContextAI

The affected component is the Lockme OAuth2 Calendars Integration plugin (CPE: cpe:2.3:a:lustmored:lockme_calendars_integration:*:*:*:*:*:*:*:*), a WordPress plugin that bridges the Lockme booking/calendar SaaS platform with WordPress sites via OAuth2. The vulnerability is a textbook CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS) arising from two independent failures in Plugin.php: first, the WordPress Settings API call register_setting() at line 197 omits the 'sanitize_callback' parameter, meaning WordPress performs no server-side cleansing before persisting values to wp_options via update_option(); second, when the admin settings page is rendered, the retrieved option values are echoed directly into HTML input value attributes at lines 212, 223, 245, and 256 without wrapping in WordPress's esc_attr() escaping function. An attacker-controlled string containing a double-quote followed by an event handler (e.g., " onmouseover="..." or closing the attribute and adding a script tag) survives both the write and read path intact. All four OAuth2-related fields are independently vulnerable, meaning any one of them can serve as the injection vector. The scope change (S:C) in the CVSS vector reflects that injected JavaScript executes in the victim's browser session, which may be a super-administrator with authority beyond the compromised site, particularly in multisite deployments.

RemediationAI

The primary fix is to update the Lockme Calendars Integration plugin to a version that incorporates the upstream patch committed at WordPress SVN revision 3495564 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3495564%40lockme-calendars-integration&new=3495564%40lockme-calendars-integration). The specific patched release version is not independently confirmed from the available data - administrators should verify the installed version exceeds 2.11.0 and that Plugin.php lines 197 and 212/223/245/256 include a sanitize_callback (such as sanitize_text_field or a custom validator) and esc_attr() output escaping respectively. If an immediate update is not possible, a compensating control on multisite networks is to restrict the plugin settings page to super-administrators only, preventing per-site admins from accessing the vulnerable settings UI; this can be enforced by checking current_user_can('manage_network') before rendering the form. On single-site installations with fully trusted admins, no immediate compensating control is required beyond scheduling the update. The Wordfence advisory at the URL above should be monitored for confirmed patched version numbers.