This vulnerability in WP FullCalendar allows an attacker with at least low privileges and requiring user interaction to inject and store malicious scripts via improperly sanitized input. When other users view the affected pages, the stored scripts execute, potentially leading to partial compromise of confidentiality, integrity, and availability. The vulnerability affects all versions up to 1.5 inclusive. No official patch or remediation details are provided in the available data.

Successful exploitation can lead to stored cross-site scripting attacks, which may allow attackers to execute arbitrary scripts in the context of affected users. This can result in partial disclosure of information, modification of data, or disruption of service. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, user interaction needed, and scope change, with low impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to trusted users only and avoid interacting with untrusted input in the affected plugin. Monitor official channels for updates from the vendor regarding patches or mitigations.