CVE-2026-14827 — Calendar < 1.3.18 - Contributor+ Stored XSS via event_link Parameter
The Calendar WordPress plugin before 1.3.18 does not properly escape a user-supplied event field before outputting it inside an HTML attribute on a public-facing page, allowing …
Published: 2026-07-27 · CVSS: 6.8 · CVSS 3.1
The Calendar WordPress plugin before 1.3.18 does not properly escape a user-supplied event field before outputting it inside an HTML attribute on a public-facing page, allowing users with the Contributor role to inject arbitrary JavaScript that executes in the browser of anyone viewing the calendar.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7