CVE-2026-9838: ICS Calendar for WordPress XSS Vulnerability

CVE-2026-9838 Overview

CVE-2026-9838 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the ICS Calendar plugin for WordPress in all versions up to and including 12.0.9. The flaw resides in the htmltagtitle parameter, which is processed by the unauthenticated wp_ajax_nopriv_r34ics_ajax AJAX action. Attacker-controlled js_args values are merged over stored shortcode configuration without nonce verification, allowing the htmltagtitle key to bypass the shortcode allowlist. Insufficient input sanitization and output escaping enable unauthenticated attackers to inject arbitrary web scripts that execute when a victim clicks a crafted link [CWE-79].

Critical Impact
Unauthenticated attackers can inject arbitrary JavaScript that executes in a victim's browser session, enabling session theft, credential harvesting, and administrative account takeover on WordPress sites running vulnerable versions of the ICS Calendar plugin.

Affected Products

ICS Calendar plugin for WordPress — all versions up to and including 12.0.9
WordPress sites with the wp_ajax_nopriv_r34ics_ajax action reachable
Any WordPress deployment using the r34ics shortcode functionality

Discovery Timeline

2026-07-10 - CVE-2026-9838 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-9838

Vulnerability Analysis

The ICS Calendar plugin exposes an AJAX endpoint through the wp_ajax_nopriv_r34ics_ajax hook, which allows unauthenticated requests. This endpoint accepts a js_args payload from the client and merges those values on top of the stored shortcode configuration. The merge operation happens without nonce verification, breaking the normal boundary between server-side shortcode attributes and client-supplied data.

The plugin enforces an allowlist for shortcode attributes, but the merge logic permits the htmltagtitle key to bypass this check. The value is then rendered into the calendar-month.php template without adequate sanitization or output escaping. As a result, attacker-controlled markup reaches the DOM and executes in the victim's browser.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79] combined with two design weaknesses: absent nonce verification on an unauthenticated AJAX endpoint and an incomplete allowlist enforcement that permits htmltagtitle to pass through unchecked. The rendering template outputs the parameter directly rather than applying WordPress escaping functions such as esc_attr() or esc_html().

Attack Vector

An attacker crafts a URL or form submission targeting admin-ajax.php with action=r34ics_ajax and a malicious htmltagtitle value inside js_args. The attacker delivers this link to a victim through phishing, forum posts, or social media. When the victim clicks the link, the response reflects the injected script, which executes in the context of the WordPress site. User interaction is required, but no authentication or prior session on the target site is needed.

Refer to the Wordfence Vulnerability Report and the WordPress ICS Calendar source for the affected code paths at lines 33, 53, and 72 of r34ics-ajax.php, and line 40 of templates/calendar-month.php.

Detection Methods for CVE-2026-9838

Indicators of Compromise

HTTP requests to /wp-admin/admin-ajax.php containing action=r34ics_ajax combined with js_args parameters that include HTML tags, <script>, onerror=, onload=, or JavaScript URI schemes.
Referrer chains showing users arriving at the site from external URLs containing encoded htmltagtitle payloads.
Unexpected outbound requests from browser sessions to attacker-controlled domains shortly after a user visits an ICS Calendar page.

Detection Strategies

Inspect web server access logs for admin-ajax.php requests where action=r34ics_ajax appears alongside URL-encoded angle brackets or event handler attributes in js_args.
Deploy web application firewall rules to flag reflected XSS payloads targeting the htmltagtitle key.
Review the ICS Calendar plugin version across managed WordPress sites and identify hosts running 12.0.9 or earlier.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture script execution attempts from unexpected sources on pages hosting the plugin.
Alert on browser telemetry showing script execution originating from reflected query parameters on WordPress endpoints.
Track user-reported redirects or unexpected pop-ups on calendar pages, which are common downstream signals of reflected XSS exploitation.

How to Mitigate CVE-2026-9838

Immediate Actions Required

Update the ICS Calendar plugin to a version later than 12.0.9 once the vendor releases a patched build.
Audit the site for suspicious administrator accounts or unexpected plugin and theme modifications, since reflected XSS can facilitate account compromise.
Instruct users and administrators to avoid clicking untrusted links referencing the affected WordPress site until patching is complete.

Patch Information

Review the WordPress ICS Calendar Changeset for the vendor's remediation. Site operators should upgrade to the fixed release listed in the Wordfence Vulnerability Report.

Workarounds

Deactivate the ICS Calendar plugin until an updated version is installed if immediate patching is not possible.
Block or rate-limit unauthenticated requests to admin-ajax.php with action=r34ics_ajax at the web application firewall or reverse proxy layer.
Implement a strict Content Security Policy that disallows inline script execution to reduce the impact of reflected XSS.
Restrict the wp_ajax_nopriv_* action surface where the unauthenticated endpoint is not required for site functionality.

bash

# Example WAF rule pattern (ModSecurity) to block malicious htmltagtitle payloads
SecRule ARGS:action "@streq r34ics_ajax" \
    "chain,phase:2,deny,status:403,id:1029838,\
    msg:'CVE-2026-9838 ICS Calendar reflected XSS attempt'"
    SecRule ARGS_NAMES|ARGS "@rx (?i)(<script|onerror=|onload=|javascript:)" \
        "t:none,t:urlDecodeUni"