CVE-2026-9838

The ICS Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'htmltagtitle' parameter in all versions up to, and including, 12.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability is reachable via the unauthenticated wp_ajax_nopriv_r34ics_ajax AJAX action, which accepts attacker-controlled js_args values merged over stored shortcode configuration without nonce verification, allowing the htmltagtitle key to bypass the normal shortcode allowlist check.

• CWE-79

• https://plugins.trac.wordpress.org/browser/ics-calendar/tags/12.0.5.2/r34ics-ajax.php#L33
• https://plugins.trac.wordpress.org/browser/ics-calendar/tags/12.0.5.2/r34ics-ajax.php#L53
• https://plugins.trac.wordpress.org/browser/ics-calendar/tags/12.0.5.2/r34ics-ajax.php#L72
• https://plugins.trac.wordpress.org/browser/ics-calendar/tags/12.0.5.2/templates/calendar-month.php#L40
• https://plugins.trac.wordpress.org/browser/ics-calendar/tags/12.0.8.4/r34ics-ajax.php#L33
• https://plugins.trac.wordpress.org/browser/ics-calendar/tags/12.0.8.4/r34ics-ajax.php#L53
• https://plugins.trac.wordpress.org/browser/ics-calendar/tags/12.0.8.4/r34ics-ajax.php#L72
• https://plugins.trac.wordpress.org/browser/ics-calendar/tags/12.0.8.4/templates/calendar-month.php#L40
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3563728%40ics-calendar&new=3563728%40ics-calendar
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a4d91b01-5034-42b5-857f-c66c875dd562?source=cve

Published

Jul 10, 2026

Last Modified

Jul 10, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9829The Photo Gallery by 10Web – Mobile-Friendly Image Gallery p…6.5
• CVE-2026-9830The bookingpress-appointment-booking-pro WordPress plugin be…8.2
• CVE-2026-9831A race condition in the shared Extreme Platform ONE IAM Gate…6.3
• CVE-2026-9833The Tag Groups is the Advanced Way to Display Your Taxonomy …7.1
• CVE-2026-9834The WP Database Backup – Unlimited Database & Files Backup b…7.2
• CVE-2026-9836IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 …7.5
• CVE-2026-9842The Backstage - Customizer Demo Access plugin for WordPress …7.5
• CVE-2026-9843The Database for Contact Form 7, WPforms, Elementor forms pl…8.1
• CVE-2026-9844Use of default credentials vulnerability in Roche Diagnostic…8.8
• CVE-2026-9848The WP Ticket plugin for WordPress is vulnerable to SQL Inje…7.5
• CVE-2026-9851The Booking Package plugin for WordPress is vulnerable to Pr…7.2
• CVE-2026-9856A vulnerability in huggingface/transformers versions <=5.8.0…7.1