This vulnerability in mva7 The Holiday Calendar plugin allows stored cross-site scripting due to improper input neutralization during web page generation. It affects all versions up to 1.18.2.1. The vulnerability requires at least limited privileges and user interaction to exploit, and it can impact confidentiality, integrity, and availability to a limited extent. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, reflecting network attack vector, low attack complexity, privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker with limited privileges to inject malicious scripts that execute in other users' browsers, potentially leading to information disclosure, data manipulation, or disruption of service within the scope of the affected application. The impact is limited to the confidentiality, integrity, and availability of the affected system components as indicated by the CVSS score.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit user privileges to trusted users only and consider applying input validation or sanitization controls at the application or web server level to mitigate stored XSS risks. Monitor vendor channels for updates regarding patches or official mitigations.