CVE-2026-9838 is a reflected cross-site scripting vulnerability in the ICS Calendar WordPress plugin (versions <=12.0.9). The issue arises from insufficient input sanitization and output escaping of the 'htmltagtitle' parameter. The vulnerability is exploitable via the unauthenticated AJAX action 'wp_ajax_nopriv_r34ics_ajax', which merges attacker-controlled 'js_args' over stored shortcode configurations without nonce verification. This allows the 'htmltagtitle' key to bypass shortcode allowlist restrictions, enabling injection of arbitrary web scripts that execute when a user is tricked into clicking a malicious link.

Successful exploitation can lead to limited confidentiality and integrity impacts by executing attacker-controlled scripts in the context of the victim's browser. This may allow theft of sensitive information accessible to the browser or manipulation of the user interface. There is no direct impact on availability. The vulnerability requires user interaction and is exploitable remotely without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or restricting access to the vulnerable AJAX action if possible. Avoid clicking on suspicious links that may exploit this vulnerability. Monitor official room34 or ICS Calendar plugin channels for updates and apply any released patches promptly.