{"id":"CVE-2026-97642","kind":"vulnerability","aliases":["CVE-2026-97642"],"related":[],"title":"WordPress Parsidate plugin: stored XSS via calendar block theme attribute","description":"The Wp Parsidate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the calendar Gutenberg block's 'theme' attribute in versions up to, and including, 6.4. This is due to insufficient input sanitization and output escaping on the block attribute value which is concatenated directly into an HTML class attribute in the printCalendar() function without esc_attr(). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","summary":"The Wp Parsidate plugin for WordPress does not escape the calendar Gutenberg block's theme attribute before writing it into an HTML class attribute, in versions up to and including 6.4. An attacker with Contributor access or higher can store a script in a page that runs in the browser of anyone who opens it.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","wordpress","wp-parsidate"],"not_affected_if":["only-trusted-editors","plugin-not-installed"],"how_to_check":"- Check whether the Wp Parsidate plugin is installed and its version in the WordPress admin Plugins screen\n- Check whether any page uses the calendar block from this plugin and review its theme attribute","fix":null,"status":"open","published_at":"2026-11-06T10:16:38+00:00","first_seen_at":"2026-11-06T10:40:57+00:00","triaged_at":"2026-11-06T10:41:16+00:00","updated_at":"2026-11-06T10:41:16+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-06T10:41:16Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress Parsidate plugin: stored XSS via calendar block theme attribute","impact":"medium","summary":"The Wp Parsidate plugin for WordPress does not escape the calendar Gutenberg block's theme attribute before writing it into an HTML class attribute, in versions up to and including 6.4. An attacker with Contributor access or higher can store a script in a page that runs in the browser of anyone who opens it.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","wp-parsidate"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"script runs in visitors' browsers, stealing sessions or actions","analyst_note":"Check the NVD entry or the plugin's changelog for a fixed version after 6.4 and confirm whether a patch exists.","how_to_check":"- Check whether the Wp Parsidate plugin is installed and its version in the WordPress admin Plugins screen\n- Check whether any page uses the calendar block from this plugin and review its theme attribute","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","only-trusted-editors"],"who_is_affected":"Sites running the Wp Parsidate plugin at version 6.4 or earlier that let Contributor-level or higher users edit pages. Sites without the plugin, or where only trusted administrators can publish content, are less exposed. The sources do not state a fixed version.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000712,"input_tokens":4326,"output_tokens":558,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-97642':13A,16A '6.4':52B,104C 'access':57B,147C,163C 'anyon':73B 'arbitrari':152C 'attack':54B,142C 'attr':135C 'attribut':10A,37B,45B,97C,118C,128C 'authent':141C 'block':8A,34B,94C,117C 'browser':71B 'calendar':7A,32B,92C 'class':44B,127C 'concaten':122C 'contributor':56B,145C 'contributor-level':144C 'cross':87C 'cross-sit':86C 'cve':11A,14A 'direct':123C 'due':107C 'esc':134C 'escap':30B,114C 'execut':159C 'function':132C 'gutenberg':33B,93C 'higher':59B 'html':43B,126C 'includ':51B,103C 'inject':151C,165C 'input':110C 'insuffici':109C 'level':146C 'make':137C 'open':75B 'output':113C 'page':66B,156C,166C 'parsid':2A,21B,24B,78C 'plugin':3A,25B,79C 'possibl':139C 'printcalendar':131C 'run':68B 'sanit':111C 'script':63B,89C,154C 'site':88C 'store':4A,61B,85C 'theme':9A,36B,96C 'user':162C 'valu':119C 'version':47B,99C 'via':6A,90C 'vulner':83C 'web':153C 'whenev':160C 'without':133C 'wordpress':1A,18B,27B,81C 'wp':20B,23B,77C 'wp-parsid':19B 'write':39B 'xss':5A","nicknames":[],"mitigations":[],"who_affected":"Sites running the Wp Parsidate plugin at version 6.4 or earlier that let Contributor-level or higher users edit pages. Sites without the plugin, or where only trusted administrators can publish content, are less exposed. The sources do not state a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","other","wordpress","wpparsidate"],"campaign_type":null,"search_a":"'-2026':12A,15A '-97642':13A,16A 'attribut':10A 'block':8A 'calendar':7A 'cve':11A,14A 'parsid':2A 'plugin':3A 'store':4A 'theme':9A 'via':6A 'wordpress':1A 'xss':5A","search_b":"'6.4':52B 'access':57B 'anyon':73B 'attack':54B 'attribut':37B,45B 'block':34B 'browser':71B 'calendar':32B 'class':44B 'contributor':56B 'escap':30B 'gutenberg':33B 'higher':59B 'html':43B 'includ':51B 'open':75B 'page':66B 'parsid':21B,24B 'plugin':25B 'run':68B 'script':63B 'store':61B 'theme':36B 'version':47B 'wordpress':18B,27B 'wp':20B,23B 'wp-parsid':19B 'write':39B","search_c":"'6.4':104C 'access':147C,163C 'arbitrari':152C 'attack':142C 'attr':135C 'attribut':97C,118C,128C 'authent':141C 'block':94C,117C 'calendar':92C 'class':127C 'concaten':122C 'contributor':145C 'contributor-level':144C 'cross':87C 'cross-sit':86C 'direct':123C 'due':107C 'esc':134C 'escap':114C 'execut':159C 'function':132C 'gutenberg':93C 'html':126C 'includ':103C 'inject':151C,165C 'input':110C 'insuffici':109C 'level':146C 'make':137C 'output':113C 'page':156C,166C 'parsid':78C 'plugin':79C 'possibl':139C 'printcalendar':131C 'sanit':111C 'script':89C,154C 'site':88C 'store':85C 'theme':96C 'user':162C 'valu':119C 'version':99C 'via':90C 'vulner':83C 'web':153C 'whenev':160C 'without':133C 'wordpress':81C 'wp':77C","first_public_at":"2026-11-06T10:16:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97642","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97642","severity":null,"published_at":"2026-11-06T10:16:38+00:00","modified_at":"2026-11-06T10:16:38+00:00","first_seen_at":"2026-11-06T10:40:57+00:00","fetched_at":"2026-11-06T10:40:57+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}