medium6.8
CVE-2026-14827
The Calendar WordPress plugin before 1.3.18 does not properly escape a user-supplied event field before outputting it inside an HTML attribute on a public-faci…
Impact
The Calendar WordPress plugin before 1.3.18 does not properly escape a user-supplied event field before outputting it inside an HTML attribute on a public-facing page, allowing users with the Contributor role to inject arbitrary JavaScript that executes in the browser of anyone viewing the calendar.
Affected products
| Product | Affected versions |
|---|---|
| Calendar WordPress Plugin | before 1.3.18 |
Versions were read from the advisory text. No structured product data has been published for this record yet.