Stored Cross-Site Scripting in Wp Parsidate Plugin for WordPress

CVE-2026-97642

What is CVE-2026-97642?

The Wp Parsidate plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'theme' attribute in the calendar Gutenberg block. Due to inadequate input sanitization and output escaping, an attacker with Contributor-level access or higher can inject malicious scripts which execute when a user accesses the compromised page. This vulnerability particularly arises from the printCalendar() function improperly handling value concatenation directly into an HTML class attribute, leaving the site open to exploitation.

References