{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0556", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-01T21:06:53.966Z", "datePublished": "2026-02-19T04:36:14.235Z", "dateUpdated": "2026-04-08T16:59:06.583Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:59:06.583Z"}, "affected": [{"vendor": "ishitaka", "product": "XO Event Calendar", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.2.10", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The XO Event Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xo_event_field' shortcode in all versions up to, and including, 3.2.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "XO Event Calendar <= 3.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'xo_event_field' shortcode", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6bf0eef5-9276-4367-8451-017c509e443d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/xo-event-calendar/tags/3.2.10/inc/main.php?marks=1807-1816#L1807"}, {"url": "https://plugins.trac.wordpress.org/browser/xo-event-calendar/tags/3.2.10/inc/main.php?marks=1878-1882#L1878"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "timeline": [{"time": "2025-12-24T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-02-18T16:30:05.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-19T17:03:39.200124Z", "id": "CVE-2026-0556", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T17:36:34.080Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0556", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-19T17:03:39.200124Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T17:03:40.821Z"}}], "cna": {"title": "XO Event Calendar <= 3.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'xo_event_field' shortcode", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "ishitaka", "product": "XO Event Calendar", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "3.2.10"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-24T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-02-18T16:30:05.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6bf0eef5-9276-4367-8451-017c509e443d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/xo-event-calendar/tags/3.2.10/inc/main.php?marks=1807-1816#L1807"}, {"url": "https://plugins.trac.wordpress.org/browser/xo-event-calendar/tags/3.2.10/inc/main.php?marks=1878-1882#L1878"}], "descriptions": [{"lang": "en", "value": "The XO Event Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xo_event_field' shortcode in all versions up to, and including, 3.2.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-02-19T04:36:14.235Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0556", "state": "PUBLISHED", "dateUpdated": "2026-02-19T17:36:34.080Z", "dateReserved": "2026-01-01T21:06:53.966Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-19T04:36:14.235Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The XO Event Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xo_event_field' shortcode in all versions up to, and including, 3.2.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin XO Event Calendar para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del shortcode 'xo_event_field' del plugin en todas las versiones hasta la 3.2.10, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes en los atributos proporcionados por el usuario. Esto permite a atacantes autenticados, con acceso de nivel de colaborador y superior, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2026-0556", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2026-02-19T07:17:41.483", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/xo-event-calendar/tags/3.2.10/inc/main.php?marks=1807-1816#L1807"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/xo-event-calendar/tags/3.2.10/inc/main.php?marks=1878-1882#L1878"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6bf0eef5-9276-4367-8451-017c509e443d?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.2.10]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "XO Event Calendar", "source": "cna", "vendor": "ishitaka"}, "product": "xo_event_calendar", "vendor": "ishitaka"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 75.0, "confidence_source": "inferred", "scores": [{"score": 75.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T18:11:21.127251+00:00", "value": {"mitigation_remediation": ["Update the XO Event Calendar plugin to the latest version that addresses the XSS flaw", "Restrict the use of the 'xo_event_field' shortcode to administrative roles or disable it entirely on public pages", "Implement additional input validation or a Web Application Firewall rule that blocks unescaped JavaScript in shortcode attributes"], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting that allows a user with contributor or higher privileges to cause arbitrary JavaScript to run in the browsers of all users who view an affected page"}, "threat_synthesis": {"affected_systems": "This issue affects the XO Event Calendar plugin from ishitaka, in all releases up to and including version 3.2.10. Any WordPress site installing this plugin without an update fall under the risk envelope.", "description_and_impact": "The vulnerability resides in the XO Event Calendar WordPress plugin\u2019s obfuscated handling of the 'xo_event_field' shortcode. When attributes are passed to the shortcode, the plugin fails to sanitize or escape them properly, allowing an attacker to persistently inject malicious scripts. The injected payload is stored in the database and will execute whenever any site visitor loads the affected page, potentially compromising session data, hijacking accounts, or defacing content. The flaw is a classic Stored XSS (CWE\u201179).", "risk_and_exploitability": "The CVSS score is 6.4, indicating moderate severity, while the EPSS score is less than 1\u2009%, suggesting a low current exploitation probability, and it is not listed in the CISA KEV catalog. The likely attack vector requires an authenticated contributor or higher to inject the payload via the shortcode attribute; once stored, the XSS triggers for any user that views the affected content. If the site\u2019s user base is large or contains sensitive data, the potential impact escalates markedly."}}}}, "created": "2026-02-19T10:07:11.296181+00:00", "updated": "2026-04-15T18:15:10.845550+00:00", "vendors": ["ishitaka", "ishitaka$PRODUCT$xo_event_calendar", "wordpress", "wordpress$PRODUCT$wordpress"]}