CVE-2026-1902
Stored XSS in Hammas Calendar WordPress Plugin Allows Script Injection
Publication date: 2026-03-07
Last updated on: 2026-03-07
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| innovaatik | hammas_calendar | to 1.5.11 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Hammas Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'apix' parameter in the 'hp-calendar-manage-redirect' shortcode in all versions up to and including 1.5.11.
This vulnerability occurs because of insufficient input sanitization and output escaping, which allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts.
These injected scripts execute whenever a user accesses a page containing the injected content, potentially compromising user sessions or data.
How can this vulnerability impact me? :
This vulnerability can allow attackers with Contributor-level access or above to inject malicious scripts into pages viewed by other users.
The impact includes the execution of arbitrary scripts in the context of the affected site, which can lead to session hijacking, defacement, or unauthorized actions performed on behalf of other users.
Because the vulnerability is a Stored Cross-Site Scripting issue, the malicious code persists on the site and affects all users who visit the injected pages.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The vulnerability involves Stored Cross-Site Scripting (XSS) via the 'apix' parameter in the 'hp-calendar-manage-redirect' shortcode of the Hammas Calendar WordPress plugin up to version 1.5.11. Detection would involve identifying if your WordPress site is running the vulnerable plugin version and if the 'apix' parameter is being exploited.
Since the vulnerability requires authenticated users with Contributor-level access or higher to inject scripts, monitoring for unusual or suspicious input in the 'apix' parameter in requests to pages using the 'hp-calendar-manage-redirect' shortcode is key.
Specific commands to detect exploitation are not provided in the available resources. However, general detection steps could include:
- Check the installed version of the Hammas Calendar plugin to see if it is version 1.5.11 or earlier.
- Search web server logs or application logs for requests containing the 'apix' parameter with suspicious script content.
- Use web vulnerability scanners that can test for stored XSS vulnerabilities in WordPress plugins, focusing on the 'hp-calendar-manage-redirect' shortcode and the 'apix' parameter.
No explicit detection commands or scripts are provided in the resources.
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'The primary mitigation step is to update the Hammas Calendar plugin to version 1.5.12 or later, where the vulnerability has been fixed by improving input sanitization, output escaping, and URL handling.'}, {'type': 'paragraph', 'content': "Version 1.5.12 includes security improvements such as sanitizing the 'apix' parameter by converting it to an absolute integer, using nonce parameters to protect against CSRF, and properly encoding URLs to prevent injection attacks."}, {'type': 'paragraph', 'content': 'Additional immediate steps include:'}, {'type': 'list_item', 'content': 'Restrict Contributor-level and higher access to trusted users only, as the vulnerability requires authenticated users with such privileges.'}, {'type': 'list_item', 'content': "Implement Web Application Firewall (WAF) rules to detect and block suspicious payloads targeting the 'apix' parameter."}, {'type': 'list_item', 'content': "Monitor logs for unusual activity related to the plugin and the 'apix' parameter."}] [4]