This vulnerability in mva7 The Holiday Calendar plugin allows an attacker with at least low privileges and requiring user interaction to inject and store malicious scripts due to improper input sanitization during page generation. The vulnerability impacts confidentiality, integrity, and availability to a limited extent, as reflected by the CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). The issue affects all versions up to 1.18.2.1. No vendor advisory or patch links are currently available.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to limited disclosure of information, modification of data, and partial disruption of service. The impact is limited by the requirement for user interaction and low privilege level needed to exploit the vulnerability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting privileges and limiting user input where possible. Monitor vendor channels for updates and apply patches promptly once released.