CVE-2026-0868: XSS in EMC Easily Embed Calendly Scheduling Features

An attacker exploiting this XSS vulnerability can inject malicious JavaScript code into WordPress pages through the Calendly shortcode. When a user visits a page containing the injected script, the attacker's code will execute in the user's browser, potentially stealing cookies, redirecting the user to a malicious website, or defacing the website. The impact is amplified if the attacker can target users with administrative privileges, enabling them to gain full control of the WordPress site. This vulnerability shares similarities with other XSS exploits where user input is not properly sanitized before being displayed, leading to code execution within the context of the vulnerable website.

1. Reserved2026-01-12
2. Published2026-04-19
3. Modified2026-04-22
4. EPSS updated2026-04-26

The primary mitigation for CVE-2026-0868 is to upgrade the EMC – Easily Embed Calendly Scheduling Features plugin to version 4.5 or later. If immediate upgrading is not possible due to compatibility issues or testing requirements, consider implementing a Web Application Firewall (WAF) rule to filter potentially malicious input within the Calendly shortcode. Specifically, look for unusual characters or patterns commonly associated with XSS payloads. Additionally, review and sanitize any user-supplied attributes used within the shortcode to prevent further exploitation. After upgrading, confirm the fix by attempting to inject a simple JavaScript payload through the Calendly shortcode and verifying that it does not execute.

Active installs

10KNiche

Plugin rating