The Marketing Fire Editorial Calendar WordPress plugin contains improper neutralization of input during web page generation, which allows DOM-based XSS. When an affected page is rendered in a victim’s browser, an attacker could inject arbitrary script, potentially executing malicious JavaScript in the context of the site. The vulnerability is identified by CWE-79.

Any WordPress site running the Editorial Calendar plugin from any version through 3.9.0 is vulnerable. The vendor 'Marketing Fire' lists the product 'Editorial Calendar' as affected in this version range.

The CVSS v3 score of 6.5 indicates a Medium severity, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation. The vulnerability is not included in CISA’s KEV catalog. Exploitation is likely remote and would require the victim to load an affected page, typically via a crafted link or social‑engineering technique, to trigger the injected script. Based on typical XSS consequences, this could enable an attacker to steal session cookies, capture credentials or perform other client‑side malicious actions.