The Intl DateTime Calendar plugin is vulnerable to stored cross‑site scripting via the date parameter. Unsanitized input allows an authenticated user with Contributor level or higher to inject arbitrary JavaScript that is later served to every user who views the affected page. The injected code can be used to steal session cookies, deface content, or redirect users to malicious sites, compromising confidentiality, integrity, and potentially availability of the WordPress site.

All WordPress sites that use the Intl DateTime Calendar plugin by Theerawat Patthawee, version 1.0.1 or earlier, are affected. The vulnerability is present in every release up to and including 1.0.1; newer versions are not reported as vulnerable.

The CVSS score of 6.4 indicates moderate severity. Because the flaw requires an authenticated Contributor‑level account, casual or anonymous exploitation is not possible. However, once an attacker gains such a role—by compromising a contributor account or by social engineering administrative users—the stored script can be embedded through normal plugin usage. The EPSS score of less than 1 % suggests that, historically, exploitation incidents are rare, but the possibility remains, especially on widely used WordPress installations. The CVE is not yet listed in the CISA KEV catalog, so no active exploitation campaigns are tracked.