Reflected Cross-Site Scripting in ICS Calendar WordPress Plugin

Executive Summary

The ICS Calendar plugin for WordPress has a Reflected Cross-Site Scripting (XSS) vulnerability in the 'htmltagtitle' parameter in all versions up to and including 12.0.9. This occurs because the plugin does not properly sanitize input or escape output. An unauthenticated attacker can inject malicious web scripts by exploiting the wp_ajax_nopriv_r34ics_ajax AJAX action, which merges attacker-controlled js_args values over stored shortcode configurations without nonce verification. This allows the attacker to bypass normal shortcode allowlist checks and inject scripts that execute when a user is tricked into performing an action like clicking a link.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow unauthenticated attackers to execute arbitrary scripts in the context of the affected website. This can lead to the theft of user credentials, session hijacking, defacement of the website, or redirection to malicious sites. Since the attack requires user interaction, such as clicking a crafted link, it can be used in phishing attacks to compromise users who visit the vulnerable site.

Useful 0 Not Useful 0