CVE-2026-59516

HighCVSS 7.1

Published: 13/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

The ICS Calendar WordPress plugin up to version 12.1.1 contains a reflected Cross-site Scripting (XSS) vulnerability due to improper input neutralization during page generation. An attacker can inject malicious JavaScript via a crafted HTTP request.

Risk Assessment

The risk involves arbitrary script execution in the victim's browser, potentially leading to session theft, admin account takeover, or sensitive data leakage. The attack requires user interaction (e.g., clicking a link).

Recommendation

Immediately update the ICS Calendar plugin to a version newer than 12.1.1. If no update is available, temporarily disable the plugin until a patch is released.

Other vulnerabilities in ICS Calendar

CVE-2026-9838Medium
The ICS Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'htmltagtitle' parameter in all versions up to and including 12.0.9 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user clicks a crafted link, exploiting the wp_ajax_nopriv_r34ics_ajax AJAX action without nonce verification.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Room 34 Creative Services, LLC ICS Calendar ics-calendar allows Reflected XSS.This issue affects ICS Calendar: from n/a through <= 12.1.1.