Marcus Cornes

**Name of the Vulnerable Software and Affected Versions** Calendar WordPress plugin versions prior to 1.3.18 **Description** Stored Cross-Site Scripting (XSS) occurs when the plugin fails to properly escape a user-supplied event field before outputting it within an HTML attribute on a public page. This allows users with the Contributor role to inject arbitrary JavaScript via the `event link` parameter, which then executes in the browser of any user viewing the calendar. **Recommendations** Update the Calendar WordPress plugin to version 1.3.18 or later.