CVE-2026-0868 - Exploits & Severity

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)

The EMC – Easily Embed Calendly Scheduling Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's calendly shortcode in all versions up to, and including, 4.4 due to insufficient input sanitization and output escaping on user supplied attributes.

Authenticated attackers with contributor-level access and above can inject arbitrary web scripts into pages through the calendly shortcode. These malicious scripts will execute whenever a user accesses an injected page, potentially allowing attackers to steal session tokens, modify page content, redirect users to malicious sites, or perform actions on behalf of affected users.

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

No patch information available in the provided data.

Immediately update the EMC – Easily Embed Calendly Scheduling Features plugin to a version newer than 4.4. Review and audit contributor-level and above accounts for unauthorized changes to pages containing the calendly shortcode. Implement stricter access controls limiting contributor-level permissions. Monitor for suspicious use of the calendly shortcode with unusual or suspicious attributes.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

NVD published the first details for CVE-2026-0868

A CVSS base score of 6.4 has been assigned.

Feedly found the first article mentioning CVE-2026-0868 . See article

The CVE-2026-0868 vulnerability affects the EMC – Easily Embed Calendly Scheduling Features plugin for WordPress, allowing authenticated attackers with contributor-level access and above to exploit Stored Cross-Site Scripting due to insufficient input sanitization. It has a CVSS score of AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, indicating a moderate severity. The article does not provide information on proof-of-concept exploits, mitigations, detections, patches, or downstream impacts on other vendors or technologies. See article

GitHub Advisories released a security advisory .

[GHSA-w3fc-f758-c6x7] The EMC – Easily Embed Calendly Scheduling Features plugin for WordPress is vuln

CVE-2026-0868 - Exploits & Severity - Feedly

CVE-2026-0868 The EMC – Easily Embed Calendly Scheduling Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's calendly shortcode in all version…

Report: CVE-2026-0868 - EMC Scheduling Manager <= 4.4 - authenticated (contributor+) stored cross-site sc

Collect, analyze, and vulnerability reports faster using AI