The vulnerability in the Room34:ICS Calendar WordPress plugin allows reflective cross‑site scripting because the htmltagtitle parameter is unsanitized before it is sent back to the browser. An attacker can embed malicious JavaScript within that value, and the script will run in the victim’s browser when the victim visits a crafted URL or clicks a link that triggers the vulnerable AJAX action. The flaw is a classic reflected XSS (CWE‑79) and enables session hijacking, defacement or other client‑side attacks but does not grant server‑side code execution or privilege escalation.

WordPress sites that have installed the Room34:ICS Calendar plugin version 12.0.9 or any earlier release (12.0.5.x, 12.0.8.x, 12.0.9). The vulnerability resides in the AJAX handler wp_ajax_nopriv_r34ics_ajax for unauthenticated users and the associated shortcode that merges user data without proper validation.

The CVSS score of 6.1 indicates moderate severity, and the EPSS score of < 1 % suggests low probability of widespread exploitation at present. The plugin is not listed in CISA KEV. The attack requires the attacker to craft a js_args payload that includes a malicious htmltagtitle value, and a victim must be convinced to load a page that makes the unauthenticated AJAX request. If successful, the injected script runs in the victim’s browser, potentially stealing session cookies or manipulating the page.