The Calendar WordPress plugin fails to escape the event_link field before rendering it within an HTML attribute on a public page. Users holding the Contributor role can insert arbitrary JavaScript into that field, which is then stored and executed in the browsers of any visitor viewing the calendar. This creates a classic stored XSS flaw (CWE‑79) that can lead to session hijacking, cookie theft, or defacement of the site from the victim’s perspective.

WordPress sites running the Calendar plugin, any release prior to 1.3.18, including 1.3.17 and earlier. The vendor is listed as Unknown:Calendar; the vulnerability is limited to plugin versions older than 1.3.18.

The CVSS score of 6.8 indicates moderate severity, and the EPSS score is 0.00235 (less than 0.1%), indicating a very low probability of exploitation, though it is not impossible. The vulnerability is not recorded in CISA’s KEV catalog. Exploitation requires access to a Contributor account, after which injected code is displayed to all users who view the affected calendar page, making it a moderate‑risk, low‑complexity attack that can affect all visitors of the public calendar. Organizations should consider the potential for malicious code to run in end‑user browsers when deciding on mitigation steps.