Description
The Wp Parsidate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the calendar Gutenberg block's 'theme' attribute in versions up to, and including, 6.4. This is due to insufficient input sanitization and output escaping on the block attribute value which is concatenated directly into an HTML class attribute in the printCalendar() function without esc_attr(). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2026-11-06
Score: 6.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Stored Cross‑Site Scripting
Action: Apply Patch
AI Analysis

Impact

The WP Parsidate plugin for WordPress contains a stored cross‑site scripting flaw in versions up to and including 6.4. This vulnerability results from the calendar Gutenberg block’s 'theme' attribute being concatenated directly into an HTML class attribute without proper sanitization or escaping. An attacker with Contributor or higher privileges can inject arbitrary JavaScript that will execute for any user who views a page containing the injected block, allowing session hijacking, defacement, or data exfiltration.

Affected Systems

The affected product is the WP Parsidate plugin released by man4toman. Any WordPress site running version 6.4 or earlier of this plugin is considered vulnerable; no further sub‑version details are provided.

Risk and Exploitability

The CVSS score of 6.4 indicates moderate severity. EPSS is not available, so the current likelihood of exploitation cannot be quantified, and the vulnerability is not listed in CISA's KEV dataset. The attack vector requires authenticated access with at least Contributor level, after which the malicious script runs for all users who view the page containing the injected block.

Generated by OpenCVE AI on November 6, 2026 at 10:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the WP Parsidate plugin to the latest available version, or uninstall it if no update is presently released.
  • If an immediate update is not possible, deactivate the plugin entirely until a patched version is released to prevent exploitation.
  • Temporarily revoke or restrict Contributor privileges from adding or editing blocks that could inject the 'theme' attribute, and audit existing content for the vulnerable block before re‑activating the plugin.

Generated by OpenCVE AI on November 6, 2026 at 10:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 07 Nov 2026 07:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 06 Nov 2026 09:45:00 +0000

Type Values Removed Values Added
Description The Wp Parsidate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the calendar Gutenberg block's 'theme' attribute in versions up to, and including, 6.4. This is due to insufficient input sanitization and output escaping on the block attribute value which is concatenated directly into an HTML class attribute in the printCalendar() function without esc_attr(). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Title Wp Parsidate <= 6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'theme' Block Attribute
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-11-06T15:02:14.239Z

Reserved: 2026-09-24T18:19:38.612Z

Link: CVE-2026-97642

cve-icon Vulnrichment

Updated: 2026-11-06T15:02:08.233Z

cve-icon NVD

Status : Deferred

Published: 2026-11-06T10:16:38.320

Modified: 2026-11-06T15:17:27.440

Link: CVE-2026-97642

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-06T10:30:18Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')