The vulnerability lies in the calendly shortcode of the EMC – Easily Embed Calendly Scheduling plugin for WordPress. Because user supplied attributes are not properly sanitized or escaped, an authenticated contributor‑level user can inject arbitrary JavaScript that is stored in the post content. When an affected page is later displayed, the injected script will execute in the context of any visitor, potentially allowing credential theft, defacement, or other malicious actions. This flaw is classified under CWE‑79.

WordPress sites that have installed the EMC – Easily Embed Calendly Scheduling plugin in version 4.4 or earlier are affected. The issue exists in all plugin releases up through 4.4, irrespective of the WordPress core version. Users with contributor or higher privileges can exploit the flaw because they can edit the content that contains the shortcode.

The CVSS score of 6.4 indicates moderate severity. No EPSS data is available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a legitimate WordPress account with at least contributor rights and the ability to edit posts or pages that use the calendly shortcode. Once the payload is stored, any visitor to the affected page will be exposed to the injected script, making the attack highly effective against users who view the malicious content.