Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Hammas Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'apix' parameter in the 'hp-calendar-manage-redirect' shortcode in all versions up to, and including, 1.5.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-1902 Stored XSS in Hammas Calendar WordPress Plugin via 'apix' Parameter https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-1902
Post summary
The entry announces a stored XSS vulnerability in the Hammas Calendar WordPress plugin triggered through the 'apix' parameter, with no PoC, exploit, or patch details provided.
🚨*CVE* CVE-2026-1902 The Hammas Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'apix' parameter in the 'hp-calendar-manage-redirect' shortcode in all ver… https://www.cve.org/CVERecord?id=CVE-2026-1902 ----- Traducción: CVE-2026-1902 El … http://infoflow.cloud`
Post summary
The post announces CVE‑2026‑1902, a stored XSS vulnerability in the Hammas Calendar WordPress plugin, but provides no PoC, exploit, or patch information.
CVE-2026-1902 The Hammas Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'apix' parameter in the 'hp-calendar-manage-redirect' shortcode in all ver… https://www.cve.org/CVERecord?id=CVE-2026-1902
Post summary
A stored XSS vulnerability was disclosed in the Hammas Calendar WordPress plugin through the 'apix' parameter.