CVE-2026-3367

Name of the Vulnerable Software and Affected Versions Lockme OAuth2 calendars integration versions prior to 2.11.1

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. The register setting() function lacks a sanitize callback, allowing unsanitized data to be stored via update option(). When the settings page is rendered, stored values are echoed directly into an HTML input value attribute without using esc attr(). This allows authenticated attackers with administrator-level access to inject arbitrary web scripts that execute when a user accesses the plugin settings page. The affected variables include client id (App ID), client secret (App Secret), id prefix (Bookings ID prefix), and api domain (API domain). This issue is especially critical in WordPress multisite installations, as it could allow site administrators to execute JavaScript affecting other users.

Recommendations Update to a version newer than 2.11.0.