The Pie Calendar plugin for WordPress contains a stored cross‑site scripting flaw that originates in the piecal shortcode. Insufficient input sanitization and output escaping allow an authenticated user with contributor-level access or higher to embed arbitrary JavaScript in the shortcode attributes. When a page containing the malicious shortcode is viewed, the injected script executes in the browsers of any visitors to that page.

Versions of the Pie Calendar plugin, marketed as Events Calendar Made Simple – Pie Calendar, up to and including version 1.2.5 are vulnerable. The issue affects any WordPress installation that has those plugin versions installed.

With a CVSS score of 6.4 and an EPSS probability of less than 1 %, the likelihood of exploitation is considered moderate but with low observed activity. The vulnerability is not listed in CISA's KEV catalog, indicating no widespread exploitation has been reported. Attacks require an authenticated contributor or higher to craft the malicious shortcode, after which the compromised content is rendered to any visitor of the affected page.