The Cal.com WordPress plugin is vulnerable to stored cross site scripting, allowing an attacker to inject malicious JavaScript that is rendered in the browsers of users who view content managed by the plugin. An attacker exploiting this flaw can execute arbitrary code in the victim’s browser, potentially stealing session cookies, defacing site interfaces, or hijacking user interactions. The weakness is a classic example of improper input sanitization, identified as CWE‑80.

The vulnerability affects all installations of the Cal.com plugin with version 1.0.0 or earlier. This includes every site that has the plugin installed without updating to a later release that contains the fix.

The vulnerability carries a CVSS score of 6.5, reflecting a medium severity threat. The EPSS score is below 1%, indicating a low estimated likelihood of exploitation at present. The flaw is not listed in the CISA KEV catalog, but the stored nature of the XSS means that any user who can submit or edit content through the affected plugin is at risk. The most likely attack vector is user‑generated content that is saved to the database and rendered without proper escaping. Due to the low EPSS, the risk is moderate, but the impact on user browsers warrants prompt remediation.