The flaw lets an attacker inject malicious JavaScript into the plugin’s HTML output, resulting in stored XSS; when a browser renders a page that includes the widget, the attacker’s script executes with the privileges of the page’s user, allowing data theft, session hijacking, or further malicious actions.

WordPress sites using the bramwaas Simple Google Calendar Outlook Events Block Widget plugin version 2.5.0 or earlier are vulnerable; the vulnerability was identified in all releases up to and including 2.5.0 and is fixed in later versions (2.6.0+).

The CVSS score of 6.5 indicates a medium severity vulnerability. The EPSS score of <1% suggests a low probability of exploitation at the time of analysis, and the issue is not listed in CISA’s KEV catalog. Likely exploitation would involve an attacker with write access to the plugin’s configuration or event data, inserting payloads that are stored and rendered on page load, thereby compromising any user who views a page that displays the widget.