A stored cross-site scripting flaw exists in the event type feature of the HumHub Calendar module. The flaw allows an attacker with administrative privileges to embed malicious scripts that are saved in the database, and the scripts execute in the browsers of any user who views the event. This can lead to arbitrary JavaScript execution, enabling session hijacking, credential theft, or defacement within the victim's session. The attack only affects users who view events created by an administrative account; normal users browsing events are impacted after the admin injects the malicious content.

The vulnerability impacts the HumHub Calendar module (humhub:calendar) and is present in all releases earlier than version 1.8.11. Administrators running HumHub Calendar 1.8.10 or older are vulnerable; the issue was corrected in version 1.8.11.

The CVSS score of 6.9 denotes medium severity, while the EPSS score of less than 1 % indicates a low likelihood of exploitation in the wild. The vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an attacker to have administrative access to insert malicious content into event types, after which any authenticated user viewing the event will have the stored script executed in their browser.