CVE-2026-14827
Vulnerability Description
The Calendar WordPress plugin before 1.3.18 does not properly escape a user-supplied event field before outputting it inside an HTML attribute on a public-facing page, allowing users with the Contributor role to inject arbitrary JavaScript that executes in the browser of anyone viewing the calendar.
Vulnerability Details
Published Date
Last Modified
Source
NVD
Vendor
Unknown
Product
Calendar
Discussion (0)
Add Comment
No comments yet. Be the first!