PT-2026-64851 · WordPress · Calendar

Marcus Cornes · CVE-2026-14827 · Published 2026-07-27 · Updated 2026-07-27

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Calendar WordPress plugin versions prior to 1.3.18

Description Stored Cross-Site Scripting (XSS) occurs when the plugin fails to properly escape a user-supplied event field before outputting it within an HTML attribute on a public page. This allows users with the Contributor role to inject arbitrary JavaScript via the event link parameter, which then executes in the browser of any user viewing the calendar.

Recommendations Update the Calendar WordPress plugin to version 1.3.18 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-14827

Affected Products

Calendar

References · 3

• 🔥 https://wpscan.com/vulnerability/b2981b41-b712-43d9-a327-3a376346cec5 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-14827 · Security Note
• https://t.me/CVEtracker/61307 · Telegram Post