Calendar < 1.3.18 – Contributor+ Stored XSS via event_link Parameter | CVE 2026-14827

Description

The plugin does not properly escape a user-supplied event field before outputting it inside an HTML attribute on a public-facing page, allowing users with the Contributor role to inject arbitrary JavaScript that executes in the browser of anyone viewing the calendar.

Proof of Concept

Prerequisite: the plugin's event-management capability is at its default (Contributor / edit_posts).

1. Log in as a Contributor.
2. Go to Calendar > Manage Calendar (wp-admin/admin.php?page=calendar).
3. Add a new event with any title and a valid begin/end date in the currently displayed month. In the "Link" field, enter this exact value:

https://example.com" onmouseover="alert(1)

4. Save the event.
5. As any visitor (no login required), open the public page that renders the calendar via the [calendar] shortcode (e.g. https://victim.example/calendar/).
6. Move the mouse over the event's link.

Result: the stored value breaks out of the href attribute, producing <a href="https://example.com" onmouseover="alert(1)" >, and alert(1) executes in the visitor's browser.