CVE-2009-3157: Karen Stevenson Calendar

Low severity, CVSS 3.5. EPSS: 1% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in the Calendar module 6.x before 6.x-2.2 for Drupal allows remote authenticated users, with "create new content types" privileges, to inject arbitrary web script or HTML via the title of a content type.

Affected products

• Karen Stevenson Calendar: version 6.x-2.0 only; version 6.x-2.1 only; version 6.x-2.x-dev only

Published 2009-09-10. Last modified 2026-06-16.