CVE-2026-3367
Received Received - Intake

Stored XSS in Lockme OAuth2 Calendars WordPress Plugin

Publication date: 2026-07-11

Last updated on: 2026-07-11

Assigner: Wordfence

Description
The Lockme OAuth2 calendars integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'App ID' setting in all versions up to, and including, 2.11.0. This is due to insufficient input sanitization and output escaping. The register_setting() call on line 197 lacks a sanitize callback, allowing unsanitized data to be stored via update_option(). When the settings page is rendered, the stored value is echoed directly into an HTML input's value attribute without esc_attr() on line 212. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in the settings page that will execute whenever a user accesses the plugin settings page. Multiple fields are affected: App ID (client_id), App Secret (client_secret), Bookings ID prefix (id_prefix), and API domain (api_domain). This vulnerability is particularly impactful in WordPress multisite installations where administrators of individual sites should not be able to execute JavaScript affecting other users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-11
Last Modified
2026-07-11
Generated
2026-07-11
AI Q&A
2026-07-11
EPSS Evaluated
N/A
NVD
CVE-2026-3367
EUVD
EUVD-2026-43124

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
lockme oauth2_calendars_integration_plugin to 2.11.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Lockme OAuth2 calendars integration plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in its 'App ID' setting and several other fields. This happens because the plugin does not properly sanitize or escape input data before storing and displaying it. Specifically, the register_setting() function lacks a sanitize callback, allowing malicious scripts to be saved via update_option(). When the settings page is viewed, these scripts are executed because the stored values are output directly into HTML input fields without proper escaping.

Only authenticated users with administrator-level access or higher can exploit this vulnerability by injecting arbitrary web scripts into the plugin's settings page. Multiple fields are affected, including App ID (client_id), App Secret (client_secret), Bookings ID prefix (id_prefix), and API domain (api_domain).

This issue is especially serious in WordPress multisite environments, where administrators of individual sites could inject JavaScript that affects other users across the network.

Impact Analysis

This vulnerability allows an attacker with administrator-level access to inject and execute arbitrary JavaScript code within the plugin's settings page. This can lead to several impacts:

  • Execution of malicious scripts in the context of the WordPress admin dashboard.
  • Potential theft of sensitive information such as authentication tokens or cookies.
  • Manipulation or defacement of the plugin settings or other parts of the WordPress admin interface.
  • In multisite installations, an attacker could affect other sites and users beyond their own site.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-3367. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart