This vulnerability in Contact Form 7 Calendar (<= 3.0.1) allows an attacker to exploit a CSRF weakness to inject stored XSS payloads. The CVSS 3.1 score of 7.1 indicates a high impact with network attack vector, low attack complexity, no privileges required, user interaction needed, and scope changed. The vulnerability can result in partial confidentiality, integrity, and availability impacts.

Successful exploitation can lead to stored XSS, enabling attackers to execute malicious scripts in the context of affected users. This can compromise user data confidentiality, integrity, and availability of the affected web application. The vulnerability requires user interaction but no privileges, and can be triggered remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or restricting access to the vulnerable plugin to prevent exploitation. Monitor official vendor channels for updates.