Improper Neutralization of Input During Web Page Generation, also known as Cross‑Site Scripting, allows an attacker to embed malicious scripts that are stored and later served to users. The vulnerability is contained in the Ethiopian Calendar plugin by Kibru Demeke and can lead to session hijacking, defacement, or injection of additional malicious content when users view affected pages. The weakness is a classic Stored XSS (CWE‑79).

The affected product is the WordPress plugin “Ethiopian Calendar” released by Kibru Demeke. Versions up to and including 1.1.1 are vulnerable; modern WordPress sites that have installed this plugin before that release are at risk.

The CVSS score for this issue is 6.5, indicating a medium severity. The EPSS score is below 1 %, showing it is rarely exploited in the wild, and it is not listed in the CISA KEV catalog. Because the flaw requires an attacker can submit data that is stored by the plugin, the likely attack vector is via the plugin’s administrative interface or user‑submitted content. Exploitation would allow the attacker to run arbitrary client‑side code in the context of the affected site’s users.