CVE-2026-9838 describes a reflected cross-site scripting vulnerability in the ICS Calendar WordPress plugin affecting all versions up to and including 12.0.9. The vulnerability is due to improper neutralization of input during web page generation (CWE-79). Specifically, the 'htmltagtitle' parameter can be manipulated via the unauthenticated AJAX action 'wp_ajax_nopriv_r34ics_ajax' that accepts attacker-controlled 'js_args' merged over stored shortcode configuration without nonce verification. This allows the 'htmltagtitle' key to bypass normal shortcode allowlist checks, enabling injection of arbitrary JavaScript that executes when a user interacts with a malicious link.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the context of the affected site, potentially leading to user session hijacking, defacement, or other client-side impacts. The vulnerability requires user interaction (clicking a crafted link) and affects confidentiality and integrity of user data. Availability is not impacted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the vulnerable AJAX action or restricting access to it if possible. Avoid clicking on suspicious links that may exploit this vulnerability. Monitor vendor channels for updates and apply patches promptly once released.