What is the CVSS score of EUVD-2026-43430?

EUVD-2026-43430 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of ICS Calendar are affected by EUVD-2026-43430?

The ICS Calendar WordPress plugin (versions ≤12.1.1) contains a reflected cross-site scripting vulnerability enabling attackers to hijack WordPress administrator sessions through malicious URLs.

How to fix or mitigate EUVD-2026-43430?

Within 24 hours: Inventory all WordPress installations running ICS Calendar plugin versions ≤12.1.1 and immediately disable the plugin or restrict network access to affected administrator pages; review WordPress access logs for unauthorized administrator login patterns and session anomalies. Within 7 days: Contact Room 34 Creative Services to confirm patch availability and timeline, evaluate replacement calendar plugins, and implement compensating controls listed below. Monitor Web Application Firewall and login logs for exploitation attempts. Within 30 days: Complete migration to a patched or alternative calendar plugin and conduct a full administrator account audit to detect any unauthorized access during the vulnerability exposure window.

ICS Calendar EUVD-2026-43430

| CVE-2026-59516 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

WordPress XSS Wordpress Plugin Ics Calendar

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Reflected XSS needs no attacker auth (PR:N) but requires the victim to click a link (UI:R); scope changes to the WordPress app (S:C) with limited C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:22 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Room 34 Creative Services, LLC ICS Calendar ics-calendar allows Reflected XSS.This issue affects ICS Calendar: from n/a through <= 12.1.1.

AnalysisAI

Reflected cross-site scripting in the ICS Calendar WordPress plugin (by Room 34 Creative Services) affects all versions from initial release through 12.1.1, letting an attacker craft a malicious URL that, when opened by a victim, injects arbitrary script into the rendered page. Because the CVSS scope is changed (S:C), successful execution can affect resources beyond the vulnerable component, including a logged-in administrator's WordPress session. No public exploit identified at time of analysis, and it is not on the CISA KEV list.

Technical ContextAI

The affected component is ICS Calendar, a WordPress plugin that imports and displays iCalendar (.ics) feeds within WordPress pages. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controllable input is reflected into an HTML response without adequate output encoding or sanitization. The single CPE entry cpe:2.3:a:room_34_creative_services,_llc:ics_calendar:*:*:*:*:*:*:*:* confirms the product is the plugin itself across all versions. As a reflected variant, the malicious payload is not stored server-side but is echoed back from the request (typically a query parameter) into the page, executing in the victim's browser under the origin of the WordPress site.

RemediationAI

Upgrade the ICS Calendar plugin to the first release above 12.1.1 as published on the WordPress plugin repository; the available data confirms all versions through 12.1.1 are vulnerable but does not state an exact patched version number, so treat this as patch available per vendor/Patchstack advisory and verify the fixed release before deploying. Consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/ics-calendar/vulnerability/wordpress-ics-calendar-plugin-12-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve) for the confirmed fixed version. If immediate upgrade is not possible, deploy a web application firewall or Patchstack's virtual patch to filter reflected XSS payloads against the plugin's request parameters (trade-off: WAF rules can be bypassed and may block legitimate calendar feed URLs), restrict administrative access to trusted networks, and educate privileged users not to click untrusted calendar/plugin links since exploitation requires victim interaction. Consider temporarily disabling the ICS Calendar plugin if it is not business-critical (trade-off: calendar rendering will be unavailable).