Medium severity6.8NVD Advisory· Published Jul 27, 2026· Updated Jul 27, 2026

CVE-2026-14827

Description

The Calendar WordPress plugin before 1.3.18 does not properly escape a user-supplied event field before outputting it inside an HTML attribute on a public-facing page, allowing users with the Contributor role to inject arbitrary JavaScript that executes in the browser of anyone viewing the calendar.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Calendarllm-fuzzy
Range: <1.3.18
Package: https://wordpress.org/plugins/calendar

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/b2981b41-b712-43d9-a327-3a376346cec5/nvd

News mentions

No linked articles in our index yet.

cvss	0.442
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000