CVE-2026-14827

The Calendar WordPress plugin (versions before 1.3.18 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The application fails to properly escape a user-supplied event field before rendering it within an HTML attribute on a public-facing page. This allows users with the Contributor role...