6.8
Medium
CVE-2026-14827 The Calendar WordPress plugin before 1.3.18 does not properly escape a user-supplied event field before outputting it…
Description
The Calendar WordPress plugin before 1.3.18 does not properly escape a user-supplied event field before outputting it inside an HTML attribute on a public-facing page, allowing users with the Contributor role to inject arbitrary JavaScript that executes in the browser of anyone viewing the calendar.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Calendar 1.3 | earliest → < 1.3.18 | 1.3.18 |