Medium · 4.1 CVE-2022-36390 EUVD-2022-39103GHSA-qfvq-h39h-4m98

WordPress Event Calendar – Calendar plugin <= 1.4.6 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability

Published Sep 21, 2022 · Updated Apr 28, 2026 · Assigned by Patchstack

Description

Authenticated (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Totalsoft Event Calendar – Calendar plugin <= 1.4.6 at WordPress.

Vendor	Product	Affected	Fixed
Totalsoft	Event Calendar – Calendar (WordPress plugin)	<= 1.4.6 – ≤ 1.4.6	—