CVE-2015-9270: Theholidaycalendar Holiday Calendar

Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days.

XSS exists in the the-holiday-calendar plugin before 1.11.3 for WordPress via the thc-month parameter.

Affected products

• Theholidaycalendar Holiday Calendar: before 1.11.3 (fixed in 1.11.3)

Published 2018-10-01. Last modified 2026-06-17.