Ics Calendar Vulnerabilities

The ICS Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 12.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses...

CVSS:

7.2

Affected:

up to 12.1.1

Fixed in:

12.1.1.1

Disclosed:

Jul 10, 2026

CVE-2026-59516 on NVD →

The ICS Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'htmltagtitle' parameter in all versions up to, and including, 12.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages th...

CVSS:

6.1

Affected:

up to 12.0.9

Fixed in:

12.0.9.2

Disclosed:

Jul 9, 2026

CVE-2026-9838 on NVD →

[en] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Server-Side Request Forgery (SSRF) vulnerability in Room 34 Creative Services, LLC ICS Calendar ics-calendar allows Absolute Path Traversal, : Server Side Request Forgery.This issue affects ICS Calendar: from n/a through 10.12.0.3.

Affected:

up to 10.12.0.3

Fixed in:

10.12.0.3

Disclosed:

May 17, 2024

CVE-2023-46784 on NVD →

The ICS Calendar plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 10.12.0.2. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

CVSS:

8.8

Affected:

up to 10.12.0.2

Fixed in:

10.12.0.3

Disclosed:

Oct 26, 2023

CVE-2023-46784 on NVD →

The ICS Calendar plugin for WordPress is vulnerable to Directory Traversal in all versions up, and including, 10.12.0.1 via the _url_get_contents function. This makes it possible for authenticated attackers, with contributor access and above, to read the contents of arbitrary files on the server, which can contain sens...

CVSS:

6.5

Affected:

up to 10.12.0.2

Fixed in:

10.12.0.2

Disclosed:

Oct 23, 2023

CVE-2023-46784 on NVD →

The ICS Calendar plugin for WordPress is vulnerable to Directory Traversal in all versions up, and including, 10.12.0.1 via the _url_get_contents function. This makes it possible for authenticated attackers, with contributor access and above, to read the contents of arbitrary files on the server, which can contain sens...

Affected:

up to 10.12.0.2

Fixed in:

10.12.0.2

Disclosed:

Oct 23, 2023