This flaw is a Cross‑Site Request Forgery that enables an attacker to inject malicious script into data stored by the Bg Orthodox Calendar plugin. The resulting stored XSS can be executed whenever a site visitor loads the affected content, potentially allowing the attacker to hijack sessions, steal user credentials, deface the site, or redirect users to phishing pages. The weakness is identified as CWE‑352 for CSRF, and the stored XSS effect is a secondary exploitation tier.

Any WordPress installation that includes the Bg Orthodox Calendar plugin version 0.13.10 or earlier is affected. The plugin is maintained by Vadim Bogaiskov and is integrated as a WordPress component; the vulnerability applies to all sites running WordPress that have not upgraded past the stated limit.

The CVSS score of 7.1 places the flaw in the high category, while the EPSS score of less than 1% suggests that active exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Attackers would likely craft a forged request, possibly leveraging a logged‑in user session, to trigger an operation that stores malicious payloads. Once stored, the XSS will run in any visitor’s browser, making the attack available to all users of the affected site.