Cve-2026-15984 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cve-2026-15984/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 05 Sep 2026 07:30:16 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgStored Cross-Site Scripting in WordPress QuickCal Pluginhttps://feed.craftedsignal.io/briefs/2026-09-quickcal-xss/Sat, 05 Sep 2026 07:30:16 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-quickcal-xss/The QuickCal WordPress plugin is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) via custom field parameters, allowing attackers to execute arbitrary scripts in the context of site users.The QuickCal plugin for WordPress, in versions up to and including 1.0.20, contains a security vulnerability (CVE-2026-15984) resulting from insufficient input sanitization and output escaping. This flaw allows unauthenticated attackers to perform Stored Cross-Site Scripting (XSS) attacks by injecting arbitrary web scripts through custom field parameters. The vulnerability is exacerbated by the improper exposure of a security nonce used to protect the booked_add_appt AJAX action. This nonce is publicly embedded within the HTML source of any page utilizing the booking calendar shortcode. Because the nonce is easily retrievable by unauthenticated actors, they can successfully perform unauthorized actions and store malicious scripts that execute whenever a victim views the affected page.

Impact

Successful exploitation of this vulnerability permits unauthenticated attackers to execute arbitrary JavaScript in the context of a victim's session. This may lead to unauthorized data access, session hijacking, or the defacement of the affected WordPress site. Given the plugin's purpose, high-traffic booking pages are at particular risk, potentially exposing administrators and customers to credential theft or redirection to malicious sites.

Recommendation

  • Immediately update the QuickCal plugin to the latest version (patch for 1.0.20 or later) as provided by the developer.
  • If an update is not immediately available, disable the booking calendar shortcode on all public-facing pages to prevent the leakage of the booked_add_appt AJAX nonce.
  • Audit web server logs for suspicious HTTP POST requests directed to the booked_add_appt AJAX endpoint.
  • Implement a robust Content Security Policy (CSP) that restricts script execution to trusted domains, mitigating the impact of potential XSS injections.
]]>highadvisorywordpressxsscve-2026-15984