CVE-2018-18872: Kieranoshea Calendar

Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days.

The Kieran O'Shea Calendar plugin before 1.3.11 for WordPress has Stored XSS via the event_title parameter in a wp-admin/admin.php?page=calendar add action, or the category name during category creation at the wp-admin/admin.php?page=calendar-categories URI.

Affected products

• Kieranoshea Calendar: before 1.3.11 (fixed in 1.3.11)

Published 2019-05-13. Last modified 2026-06-17.