PatchSiren cyber security CVE debrief
CVE-2026-9838 room34 CVE debrief
The ICS Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'htmltagtitle' parameter in all versions up to, and including, 12.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability is reachable via the unauthenticated wp_ajax_nopriv_r34ics_ajax AJAX action, which accepts attacker-controlled js_args values merged over stored shortcode configuration without nonce verification, allowing the htmltagtitle key to bypass the normal shortcode allowlist check. Users of the ICS Calendar plugin for WordPress, particularly those with unauthenticated access to the affected AJAX action, should be aware of this vulnerability and take steps to mitigate it.
- Vendor
- room34
- Product
- ICS Calendar
- CVSS
- MEDIUM 6.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-10
- Original CVE updated
- 2026-07-10
- Advisory published
- 2026-07-10
- Advisory updated
- 2026-07-10
Who should care
Users of the ICS Calendar plugin for WordPress, particularly those with unauthenticated access to the affected AJAX action, should be aware of this vulnerability and take steps to mitigate it. This includes administrators, security teams, and operators who may be impacted by the vulnerability.
Technical summary
The ICS Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'htmltagtitle' parameter in all versions up to, and including, 12.0.9. The vulnerability is reachable via the unauthenticated wp_ajax_nopriv_r34ics_ajax AJAX action, which accepts attacker-controlled js_args values merged over stored shortcode configuration without nonce verification. This allows the htmltagtitle key to bypass the normal shortcode allowlist check.
Defensive priority
Medium priority due to the CVSS score of 6.1 and the potential for unauthenticated attackers to inject arbitrary web scripts.
Recommended defensive actions
- Update the ICS Calendar plugin to a version beyond 12.0.9.
- Implement input validation and output escaping for the 'htmltagtitle' parameter.
- Restrict access to the wp_ajax_nopriv_r34ics_ajax AJAX action.
- Monitor for suspicious activity related to the ICS Calendar plugin.
- Review compensating controls for exposed systems while remediation is scheduled and verified.
- Check relevant monitoring, detection, and logs for exposed assets that need extra review.
- Track exceptions, retest remediated assets, and close the item only after evidence is documented.
Evidence notes
The CVE record was published on 2026-07-10T09:16:54.110Z and was last modified on 2026-07-10T15:43:30.330Z. The NVD entry is currently Deferred. The ICS Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'htmltagtitle' parameter in all versions up to, and including, 12.0.9 due to insufficient input sanitization and output escaping. This vulnerability is reachable via the unauthenticated wp_ajax_nopriv_r34ics_ajax AJAX action, which accepts attacker-controlled js_args values merged over stored shortcode configuration without nonce verification.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-10T09:16:54.110Z and has not been modified since then. The NVD entry is currently Deferred.