CVE-2026-0868: Stored XSS Vulnerability in EMC Calendly Plugin for WordPress

The EMC – Easily Embed Calendly Scheduling Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 4.4. This vulnerability arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's calendly shortcode. Authenticated attackers with contributor-level access can inject arbitrary web scripts into pages, which will execute when users access those pages. The CVE-2026-0868 has been assigned a CVSS score of 6.4, indicating a medium severity level. There is currently no evidence of public proof-of-concept exploits or active exploitation. Users are advised to update the plugin to a version newer than 4.4 and review contributor-level accounts for unauthorized changes. Monitoring for suspicious use of the calendly shortcode is also recommended. The vulnerability was first reported on April 19, 2026.

Key Points: • CVE-2026-0868 affects all versions of the EMC Calendly plugin up to 4.4. • Authenticated attackers can exploit the vulnerability to execute arbitrary scripts. • No active exploitation or proof-of-concept has been reported yet.