The vulnerability is a stored XSS flaw in the WP FullCalendar plugin up to and including version 1.5. Attackers can inject malicious scripts that are rendered in the browser of any visitor to a page that uses the plugin. This can lead to cookie theft, session hijacking, or other client‑side compromise, as the script runs with the privileges of the site’s users. The weakness is classified as CWE‑79 – Improper Neutralization of Input During Web Page Generation.

WP FullCalendar is distributed by Marcus (aka @msykes). All WordPress sites that install this plugin with any release up to and including 1.5 are potentially affected, as the vulnerability spans from the first release through version 1.5.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests the likelihood of exploitation is currently low. The plugin is not listed in CISA’s KEV catalog. The most likely attack path involves an attacker inserting malicious content via the plugin’s input interface (e.g., event descriptions); any user who loads the affected page will execute the injected script. The required conditions and exact scope are not explicitly stated in the advisory, but the stored nature of the flaw implies that content is retained and displayed without proper sanitization.