This vulnerability (CVE-2024-30427) in Spiffy Plugins Spiffy Calendar is classified as CWE-79, reflecting improper neutralization of input during web page generation leading to reflected cross-site scripting (XSS). It affects all versions through 4.9.7. The vulnerability allows attackers to inject malicious scripts that are reflected back to users, potentially impacting the integrity and availability of the affected application. The CVSS 3.1 base score is 5.4, with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

Successful exploitation could allow an attacker to execute malicious scripts in the context of the affected application, potentially leading to limited integrity and availability impacts. There is no confidentiality impact reported. No known exploits have been observed in the wild.

No official patch or remediation has been announced by the vendor as of the publication date. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider applying input validation or sanitization workarounds if feasible and exercise caution with untrusted input. Monitor vendor communications for updates.