What’s Vulnerable › Vulnerabilities
CVE-2026-14827: Calendar < 1.3.18 - Contributor+ Stored XSS via event_link Parameter
- Severity: medium (CVSS 6.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-07-27 · updated 2026-07-27
- Weakness: CWE-79
Description
The Calendar WordPress plugin before 1.3.18 does not properly escape a user-supplied event field before outputting it inside an HTML attribute on a public-facing page, allowing users with the Contributor role to inject arbitrary JavaScript that executes in the browser of anyone viewing the calendar.
Affected products
- Calendar: before 1.3.18 — fixed in 1.3.18
How to fix
Upgrade to a fixed version: Calendar 1.3.18. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-14827 or the next vulnerability affects your stack