The planetcalc plugin for WordPress contains a stored cross‑site scripting flaw caused by insufficient input sanitization and output escaping of the language parameter. A malicious user with Contributor or higher privileges can inject arbitrary JavaScript that is persisted in the plugin’s data store and executed whenever a visitor loads the affected page. This allows attackers to run client‑side scripts capable of credential theft, session hijacking, defacement, or other malicious actions on all visitors to the compromised page.

WordPress sites that have the planetcalc plugin installed, in any release equal to or older than 2.2. The vulnerability is present regardless of other plugins or configurations, and it requires the presence of a user with at least Contributor role to inject the malicious payload.

The CVSS score of 6.4 classifies this as a medium severity issue. The EPSS score of less than 1% suggests that widespread exploitation is unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. Once an injection has occurred, every site visitor to the affected page will execute the stored script, exposing the site to client‑side attacks. The attack vector demands authenticated access with at least Contributor rights, so an adversary must first compromise or impersonate a user with those privileges.