Junglewise Threat Intelligence

CVE-2026-3367: Lockme OAuth2 calendars integration Stored XSS in settings page

CVE-2026-3367 · Severity: medium · CVSS 4.4 · Published 2026-07-11

Executive brief

The Lockme OAuth2 calendars integration plugin for WordPress, which connects calendar services to websites, contains a security flaw in its settings page. An attacker with administrator-level access can save malicious scripts into the plugin's configuration fields, such as the App ID or App Secret. These scripts will then execute in the browser of any other user who visits the settings page, potentially allowing the attacker to perform unauthorized actions or compromise other accounts, which is especially risky in multisite environments.

Technical details

The Lockme OAuth2 calendars integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping in its configuration settings. Specifically, the register_setting() call lacks a sanitize callback, and the stored values for 'App ID', 'App Secret', 'Bookings ID prefix', and 'API domain' are echoed directly into HTML input attributes without using esc_attr(). An authenticated attacker with administrator-level privileges can inject arbitrary web scripts into these fields. These scripts execute whenever a user views the plugin settings page, which is particularly critical in WordPress multisite environments where site-level admins could target super-admins or other users.

Affected products

  • Lockme Lockme OAuth2 calendars integration up to, and including, 2.11.0

Timeline

  • 2026-07-11: disclosed: Published date from advisory

References