[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fF7_dnHtQVHBM2CPPrhrmWwEgLMM9XDUrmMbaZ6nkkXw":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":28,"research_verified":29,"research_rounds_completed":30,"research_plan":31,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":32,"research_started_at":33,"research_completed_at":34,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":29,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":29,"source_links":35},"CVE-2026-59516","ics-calendar-unauthenticated-stored-cross-site-scripting","ICS Calendar \u003C= 12.1.1 - Unauthenticated Stored Cross-Site Scripting","The ICS Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 12.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","ics-calendar",null,"\u003C=12.1.1","12.1.1.1","high",7.2,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-10 00:00:00","2026-07-14 19:17:13",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fce6cfed1-b19c-4000-81a1-fad13dc526d3?source=api-prod",5,[22,23,24,25,26,27],"changelog.txt","class-r34ics.php","functions.php","ics-calendar.php","readme.txt","templates\u002Fprint.php","researched",false,3,"# Exploitation Research Plan - CVE-2026-59516\n\n## 1. Vulnerability Summary\nThe **ICS Calendar** plugin for WordPress is vulnerable to **Unauthenticated Stored Cross-Site Scripting (XSS)** in versions up to 12.1.1. This occurs because the plugin fetches and processes external iCalendar (ICS) feeds and renders event details (like `SUMMARY` and `DESCRIPTION`) with insufficient sanitization. Specifically, the function `r34ics_filter_the_content()` (introduced in 12.0.8.4 to handle truncated HTML) fails to perform rigorous HTML validation, allowing arbitrary scripts to be cached in WordPress transients and subsequently executed in the context of any user viewing the calendar.\n\n## 2. Attack Vector Analysis\n- **Endpoint:** `wp-admin\u002Fadmin-ajax.php`\n- **Action:** `r34ics_display_calendar` (unauthenticated AJAX action)\n- **Vulnerable Parameter:** `url` (in the AJAX request) and the content of the ICS feed fetched from that URL.\n- **Authentication:** None required (`wp_ajax_nopriv_` handler).\n- **Preconditions:** The plugin must be active. The exploit works by forcing the server to fetch a malicious ICS feed, which is then cached in a transient.\n\n## 3. Code Flow\n1. **Entry Point:** An unauthenticated user sends a request to `admin-ajax.php` with `action=r34ics_display_calendar`.\n","gemini-3-flash-preview","2026-07-15 10:09:51","2026-07-15 10:11:35",{"type":36,"vulnerable_version":37,"fixed_version":11,"vulnerable_browse":38,"vulnerable_zip":39,"fixed_browse":40,"fixed_zip":41,"all_tags":42},"plugin","12.1.1","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fics-calendar\u002Ftags\u002F12.1.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fics-calendar.12.1.1.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fics-calendar\u002Ftags\u002F12.1.1.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fics-calendar.12.1.1.1.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fics-calendar\u002Ftags"]