Description

The Wp Parsidate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the calendar Gutenberg block's 'theme' attribute in versions up to, and including, 6.4. This is due to insufficient input sanitization and output escaping on the block attribute value which is concatenated directly into an HTML class attribute in the printCalendar() function without esc_attr(). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-11-06T10:16:38.320Z",
  "pubdate": "2026-11-06T10:16:38.320Z",
  "executiveSummary": "The Wp Parsidate WordPress plugin is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This security flaw originates from inadequate input sanitization and output escaping within the calendar Gutenberg block's 'theme' attribute.\nThe vulnerability allows authenticated users, specifically those with Contributor-level access or higher, to inject malicious JavaScript into the plugin's calendar output. When an unsuspecting user navigates to a page containing the manipulated block, the injected script executes within the context of the user's browser session.\nThis can lead to unauthorized actions, such as session hijacking, credential theft, or the redirection of users to malicious domains. The vulnerability affects all versions up to and including 6.4. The risk level is elevated due to the ability of lower-privileged users to perform persistent script injection, which compromises the integrity and security of the WordPress instance and its users.",
  "technicalDetails": "The root cause of this vulnerability is improper handling of user-supplied data within the printCalendar() function of the Wp Parsidate plugin. Specifically, the 'theme' attribute of the calendar Gutenberg block is accepted as input without validation and is subsequently concatenated directly into an HTML class attribute in the rendered output.\nBecause the function fails to utilize WordPress's native escaping function esc_attr(), an attacker can inject malicious payloads that break out of the intended HTML attribute context. For example, by supplying a specially crafted payload such as '\" onmouseover=\"alert(document.cookie)\"', an attacker can inject an arbitrary event handler or additional HTML tags into the DOM.\nThe attack flow begins when an attacker with Contributor-level access (or higher) creates or edits a post or page containing the calendar Gutenberg block. During the block configuration, the attacker manipulates the 'theme' attribute to include the malicious payload. Once saved, the payload is stored persistently in the WordPress database.\nWhen a legitimate user, including administrators or visitors, views the page containing the malicious calendar block, the server-side rendering process incorporates the injected script directly into the HTML response. Upon page load, the browser interprets the payload as legitimate script or malicious event handlers. The injected code executes within the security origin of the site, granting the attacker the same permissions as the victim's session.\nThis Stored XSS vulnerability is particularly dangerous because it does not require social engineering to trigger the payload; the script executes automatically whenever the affected page is rendered. The post-exploitation impact includes the potential for full session hijacking, the performance of unauthorized actions on behalf of the victim (CSRF-like behavior), the modification of page content, or the injection of persistent malware through further browser-based attacks. The vulnerable component is the Gutenberg block rendering logic, which lacks sufficient server-side input sanitization or output escaping mechanisms."
}