calendar.songfacts.com XSS vulnerability

Vulnerable URL: http://calendar.songfacts.com/api/index.event-of-the-day.api.php?callback=prompt/OPENBUGBOUNTY/...