The Hammas Calendar plugin for WordPress exposes a stored cross‑site scripting flaw in the ‘apix’ attribute of the ‘hp‑calendar‑manage‑redirect’ shortcode. Improper input sanitization and lack of output escaping allow malicious input to be persisted, causing browsers to execute arbitrary scripts when an affected page is viewed. This gives attackers the ability to hijack user sessions, deface sites, or perform further client‑side attacks. The weakness is identified as CWE‑79, a user input reflected without sanitization.

Organisations running the Hammas Calendar WordPress plugin, specifically any installation using version 1.5.11 or earlier, are vulnerable. The CNA data identifies the product as innovaatik:Hammas Calendar; no further CPE strings are listed, so the scope is limited to this plugin rather than the WordPress core itself.

With a CVSS score of 6.4, the vulnerability is considered moderate. The EPSS score of less than 1% indicates a very low probability that the flaw is actively exploited. The issue is not listed in the CISA KEV catalog, and there is no publicly disclosed exploit known at this time. Attackers require authenticated Contributor‑level access or higher; the flaw can be triggered by submitting a malicious value for ‘apix’ in a context where the shortcode is rendered, leading to script execution for all users who view the affected content.