CVE-2026-3367: WordPress Lockme OAuth2 XSS Vulnerability

CVE-2026-3367 Overview

CVE-2026-3367 is a Stored Cross-Site Scripting (XSS) vulnerability in the Lockme OAuth2 calendars integration plugin for WordPress. The flaw affects all versions up to and including 2.11.0. Authenticated attackers with administrator-level access can inject arbitrary JavaScript into plugin settings fields. The stored payload executes whenever a user visits the plugin settings page. The vulnerability is tracked as [CWE-79] and stems from missing input sanitization and output escaping in the plugin's settings handler.

Critical Impact
Authenticated administrators can store JavaScript payloads that execute in the browsers of other users viewing the plugin settings page, an especially relevant risk in WordPress multisite deployments where per-site admins should not affect network-level users.

Affected Products

Lockme OAuth2 calendars integration plugin for WordPress — all versions up to and including 2.11.0
WordPress single-site installations running the affected plugin
WordPress multisite networks with the plugin activated on subsites

Discovery Timeline

2026-07-11 - CVE-2026-3367 published to the National Vulnerability Database (NVD)
2026-07-13 - Last updated in the NVD database

Technical Details for CVE-2026-3367

Vulnerability Analysis

The vulnerability resides in the plugin's settings registration and rendering logic within src/Plugin.php. The register_setting() call on line 197 is invoked without a sanitize_callback argument. As a result, user-supplied values submitted through the settings form are passed directly to update_option() without sanitization. When the settings page is later rendered, the stored value on line 212 is echoed into an HTML <input> element's value attribute without an esc_attr() wrapper.

Multiple settings fields are affected: App ID (client_id), App Secret (client_secret), Bookings ID prefix (id_prefix), and API domain (api_domain). Any of these fields can carry a JavaScript payload that breaks out of the attribute context and executes in the victim's browser session.

Root Cause

The root cause is a two-part failure to apply WordPress security primitives. First, register_setting() omits the sanitize_callback parameter that would normalize submitted input before storage. Second, the settings renderer uses direct echo output into an HTML attribute without esc_attr(). This combination permits raw payloads to persist in the options table and reflect unencoded into the DOM.

Attack Vector

An attacker must first hold administrator-level privileges on the WordPress site. The attacker navigates to the Lockme plugin settings page and submits a payload such as an attribute-breaking string containing an onerror or onmouseover handler in one of the affected fields. The payload is written to wp_options via update_option(). Any subsequent visit to the settings page by another administrator renders the payload, executing attacker-controlled JavaScript in that user's authenticated session. In multisite installations, a site-level administrator can therefore target super-admins who audit plugin configurations, escalating the impact beyond the attacker's original scope.

See the WordPress Plugin Source Code Line 197 and WordPress Plugin Source Code Line 212 for the vulnerable code paths.

Detection Methods for CVE-2026-3367

Indicators of Compromise

Unexpected HTML tags, <script> fragments, or event handler attributes (onerror, onload, onmouseover) stored in the wp_options table for the Lockme plugin's option keys.
Values in client_id, client_secret, id_prefix, or api_domain fields containing quote characters (", ') followed by non-alphanumeric attribute-like sequences.
Browser console errors or unexpected outbound requests generated when administrators load the plugin settings page.

Detection Strategies

Query the WordPress options table for the plugin's option name and inspect stored values for HTML metacharacters and script keywords.
Review WordPress audit logs for update_option events targeting Lockme plugin settings performed by non-super-admin users.
Deploy a Web Application Firewall (WAF) rule that inspects POST requests to options.php for the plugin's setting names and flags payloads containing angle brackets or attribute-breaking quotes.

Monitoring Recommendations

Enable a WordPress activity logging plugin to capture administrator changes to plugin settings, including field-level diffs.
Monitor for anomalous JavaScript execution on /wp-admin/ pages by reviewing Content Security Policy (CSP) violation reports if a report-only policy is configured.
Alert on new administrator account creation, role changes, or wp_users modifications that occur shortly after a settings page is accessed.

How to Mitigate CVE-2026-3367

Immediate Actions Required

Update the Lockme OAuth2 calendars integration plugin to a version newer than 2.11.0 once the vendor releases a patched release.
Audit stored plugin settings for HTML or JavaScript content and reset affected fields to known-good values.
Review the administrator user list and revoke privileges for any account that does not require administrator access.

Patch Information

Refer to the WordPress Plugin Change Set and the Wordfence Vulnerability Analysis for patch tracking and remediation guidance. Apply plugin updates through the WordPress admin plugin manager or via WP-CLI as soon as a fixed release is published.

Workarounds

Deactivate the Lockme OAuth2 calendars integration plugin until a patched version is available.
On multisite installations, restrict plugin management to super-admins by defining define('DISALLOW_FILE_MODS', true); for subsite administrators.
Deploy a WAF rule to strip or reject <, >, and attribute-breaking quote sequences in POST parameters targeting the plugin's setting keys.

bash

# Update the plugin via WP-CLI once a fixed version is released
wp plugin update lockme-calendars-integration

# Or deactivate the plugin as an interim workaround
wp plugin deactivate lockme-calendars-integration

# Inspect stored option values for suspicious content
wp option get lockme_settings --format=json