---
id: "CVE-2026-97642"
page: "https://infrastack.ai/live/CVE-2026-97642"
kind: "vulnerability"
aliases: ["CVE-2026-97642"]
title: "WordPress Parsidate plugin: stored XSS via calendar block theme attribute"
severity: "medium"
cvss: 6.4
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "wordpress", "wp-parsidate"]
not_affected_if: ["only-trusted-editors", "plugin-not-installed"]
published_at: "2026-11-06T10:16:38+00:00"
first_seen_at: "2026-11-06T10:40:57+00:00"
updated_at: "2026-11-06T10:41:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97642", "first_seen_at": "2026-11-06T10:40:57+00:00"}]
exploit_sources: []
---

# WordPress Parsidate plugin: stored XSS via calendar block theme attribute

Link for people: https://infrastack.ai/live/CVE-2026-97642 (this .md is for agents)

The Wp Parsidate plugin for WordPress does not escape the calendar Gutenberg block's theme attribute before writing it into an HTML class attribute, in versions up to and including 6.4. An attacker with Contributor access or higher can store a script in a page that runs in the browser of anyone who opens it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the Wp Parsidate plugin is installed and its version in the WordPress admin Plugins screen
- Check whether any page uses the calendar block from this plugin and review its theme attribute

## Timeline

- 2026-11-06T10:40:57+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-97642

## From the sources

The Wp Parsidate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the calendar Gutenberg block's 'theme' attribute in versions up to, and including, 6.4. This is due to insufficient input sanitization and output escaping on the block attribute value which is concatenated directly into an HTML class attribute in the printCalendar() function without esc_attr(). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_