The Sugar Calendar – Simple Event Management plugin for WordPress suffers from a reflected XSS vulnerability due to improper neutralization of input during web page generation. Specifically, the plugin uses add_query_arg and remove_query_arg functions without proper escaping of URL parameters, allowing injection of arbitrary scripts. This affects all versions up to and including 3.3.0. The vulnerability enables unauthenticated attackers to trick users into executing malicious scripts by clicking crafted links, potentially leading to information disclosure or session hijacking. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of the victim's browser session when the victim clicks a crafted link. This can lead to partial confidentiality and integrity impacts such as theft of sensitive information or manipulation of user interactions within the affected site. There is no impact on availability. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with links received from untrusted sources and consider disabling or limiting use of the affected plugin. Monitoring vendor channels for updates is recommended.