CVE-2026-97642 · Other
NO FIX YET
The Wp Parsidate plugin for WordPress does not escape the calendar Gutenberg block's theme attribute before writing it into an HTML class attribute, in versions up to and including 6.4. An attacker with Contributor access or higher can store a script in a page that runs in the browser of anyone who opens it.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Wp Parsidate plugin at version 6.4 or earlier that let Contributor-level or higher users edit pages. Sites without the plugin, or where only trusted administrators can publish content, are less exposed. The sources do not state a fixed version.
Not affected if only-trusted-editors, plugin-not-installed
Who cares wordpress, wp-parsidate
No fix yet, per the sources.
The Wp Parsidate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the calendar Gutenberg block's 'theme' attribute in versions up to, and including, 6.4. This is due to insufficient input sanitization and output escaping on the block attribute value which is concatenated directly into an HTML class attribute in the printCalendar() function without esc_attr(). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.