Cross-Site Scripting Vulnerability in Calendar Plugin from WordPress
CVE-2026-14827
Key Information:
Badges
What is CVE-2026-14827?
The Calendar Plugin for WordPress prior to version 1.3.18 is susceptible to Cross-Site Scripting (XSS) attacks due to inadequate escaping of user inputs. Specifically, the plugin fails to properly escape event fields submitted by users, which are then displayed in HTML attributes without sufficient sanitization. This oversight enables users with a Contributor role to inject malicious JavaScript code that can be executed in the browsers of visitors accessing the calendar. This type of vulnerability poses significant risks, as it can lead to session hijacking, data theft, and other malicious actions.
Affected Version(s)
Calendar 0 < 1.3.18
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.