CVE-2026-9838

Name of the Vulnerable Software and Affected Versions ICS Calendar versions prior to 12.1.0

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts into pages. This occurs when a user is tricked into clicking a malicious link. The issue is reachable via the unauthenticated wp ajax nopriv r34ics ajax AJAX action, which accepts attacker-controlled js args values merged over stored shortcode configuration without nonce verification (a security token used to prevent cross-site request forgery), allowing the htmltagtitle parameter to bypass the standard shortcode allowlist check.

Recommendations Update to a version newer than 12.0.9. Avoid using the htmltagtitle parameter in the affected AJAX action until the update is applied.