WordPress Calendar Plugin Unauthenticated XSS and Privilege Escalation

WordPress appointment-booking-calendar 1.1.24 contains multiple privilege escalation vulnerabilities that allow unauthenticated attackers to modify calendar settings and inject persistent cross-site scripting payloads through the admin.php page parameters. Attackers can inject malicious JavaScript into the 'ict' and 'ics' options or the calendar 'name' parameter via GET requests to execute arbitrary scripts when the calendar is displayed or accessed in the administration interface.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The appointment-booking-calendar plugin for WordPress versions up to 1.1.24 suffers from critical privilege escalation and persistent cross-site scripting (XSS) vulnerabilities that require no authentication to exploit. Attackers can inject malicious JavaScript payloads through GET request parameters in the admin.php page, specifically targeting the 'ict', 'ics', and calendar 'name' fields. Once injected, these payloads persist in the calendar settings and execute whenever administrators or users access the calendar interface, potentially compromising admin accounts, stealing credentials, or deploying further malware. Any WordPress installation running this vulnerable plugin version is at immediate risk, particularly those exposed to the internet without additional access controls.

Casky's 754 security skills leverage Claude AI's extended reasoning to correlate attack patterns across MITRE ATT&CK techniques TA0001 (Initial Access—unauthenticated exploitation) and TA0043 (Reconnaissance—gathering admin interface information). Practitioners using Casky would see detection findings highlighting: (1) suspicious GET request parameters to admin.php containing script tags or HTML encoding patterns indicative of XSS payloads, (2) modification of plugin option values ('ict', 'ics') without corresponding authenticated user sessions, and (3) persistence indicators showing injected code surviving across page reloads or sessions. The platform's skill-based approach would also surface privilege escalation attempts by mapping unauthenticated configuration changes to capability elevation patterns, enabling teams to identify compromise chains and respond before malicious scripts execute in administrator contexts.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2016-20084.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2016-20084

Casky has 301 skills that investigate the attack patterns behind CVE-2016-20084. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn