Improper neutralization of user-supplied input leads to reflected cross‑site scripting in the WordPress iCal Feeds plugin. The flaw allows an attacker to inject arbitrary client‑side script into a page response, enabling session hijacking, credential theft, defacement, or other malicious actions in the context of any user who views the crafted page.

The vulnerability exists in the maxi valette iCal Feeds WordPress plugin with versions from the initial release up to and including 1.5.3. Users of this plugin should verify the installed version and identify whether it falls within the affected range.

The CVSS Base score of 7.1 indicates a high impact severity. Although the EPSS score is below 1%, implying a low but non‑zero exploitation probability, the flaw is not listed in the CISA KEV catalog. The attack vector is likely through crafted URLs or form submissions that the plugin does not properly sanitize. Because the vulnerability is reflected, an attacker can reach it by directing users to a malicious link or encouraging them to submit crafted data.