The List View Google Calendar plugin for WordPress contains a stored cross‑site scripting flaw that allows an authenticated user with administrator privileges to inject arbitrary scripts into event descriptions. When an event page is viewed, the unsanitized script is executed in the visitor’s browser, enabling the attacker to hijack sessions, steal credentials, or deface the site. This vulnerability stems from inadequate input filtering and output escaping.

Vendors: kimipooh. Product: List View Google Calendar, all releases up to and including version 7.4.3. The flaw affects only multi‑site WordPress installations where the unfiltered_html capability is disabled, and it requires the attacker to have administrator‑level access.

CVSS score is 4.4, indicating a moderate severity level. The exploitability metric is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is local, as the attacker must be authenticated and possess administrative rights. Because the impact is limited to injected pages and limited to administrators, the overall risk is moderate; however, the plugin upgrade should be applied promptly to eliminate the possibility of script injection attacks.