CVE-2025-14548 is a stored Cross-Site Scripting vulnerability in the kieranoshea Calendar WordPress plugin affecting all versions up to 1.3.16. The issue stems from improper neutralization of input in the 'event_desc' parameter, which allows authenticated users with Contributor-level permissions or higher to inject malicious scripts that execute when other users view the affected pages. The attack surface depends on administrative configuration that permits lower privilege users to manage calendar events. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and partial impact on confidentiality and integrity.

Successful exploitation can lead to execution of arbitrary scripts in the context of affected users, potentially allowing theft of session tokens, defacement, or other actions limited by the privileges of the victim user. The impact is limited to confidentiality and integrity with no availability impact. The vulnerability requires authenticated access with at least Contributor-level permissions and specific plugin configuration, reducing the overall risk. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — no official fix or patch has been published for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a patch is available, administrators should review and restrict permissions to prevent lower privilege users from managing calendar events via plugin settings, thereby reducing the risk of exploitation.