CVE-2026-0868

OVERVIEW CVE-2026-0868 is a Stored Cross-Site Scripting (XSS) vulnerability in the EMC – Easily Embed Calendly Scheduling Features WordPress plugin affecting all versions up to and including 4.4. The vulnerability exists in the plugin's calendly shortcode due to insufficient input sanitization and output escaping of user-supplied attributes, allowing attackers to inject malicious scripts into pages that execute when users access the compromised content. SEVERITY This is a Medium-severity vulnerability with a CVSS score of 6.4. The attack requires network access with low complexity and necessitates low-level user privileges (contributor access or above), though it does not require user interaction to execute. The vulnerability carries a Confidentiality and Integrity impact rating, potentially allowing attackers to access sensitive information or modify page content visible to site visitors. The EPSS probability score of 0.0001 indicates this vulnerability is currently among the lower-probability exploit targets relative to the broader CVE landscape. EXPLOITATION STATUS There is no evidence of active exploitation in the wild at this time. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog and shows no presence on the Hot List for emerging threats. Additionally, no public exploit code appears to be readily available, and community attention remains limited. Organizations should nevertheless prioritize patching, particularly sites with multiple contributor-level users.