Exploitation Research Plan - CVE-2026-59516

1. Vulnerability Summary

The ICS Calendar plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) in versions up to 12.1.1. This occurs because the plugin fetches and processes external iCalendar (ICS) feeds and renders event details (like SUMMARY and DESCRIPTION) with insufficient sanitization. Specifically, the function r34ics_filter_the_content() (introduced in 12.0.8.4 to handle truncated HTML) fails to perform rigorous HTML validation, allowing arbitrary scripts to be cached in WordPress transients and subsequently executed in the context of any user viewing the calendar.

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php
• Action: r34ics_display_calendar (unauthenticated AJAX action)
• Vulnerable Parameter: url (in the AJAX request) and the content of the ICS feed fetched from that URL.
• Authentication: None required (wp_ajax_nopriv_ handler).
• Preconditions: The plugin must be active. The exploit works by forcing the server to fetch a malicious ICS feed, which is then cached in a transient.

3. Code Flow

1. Entry Point: An unauthenticated user sends a request to admin-ajax.php with action=r34ics_display_calendar.