The WP Corner Quick Event Calendar plugin for WordPress versions up to 1.4.9 contains a CSRF vulnerability that enables stored XSS attacks. An attacker can trick an authenticated user into submitting a crafted request, which results in malicious script storage within the application. This vulnerability has a CVSS 3.1 base score of 7.1, reflecting its high severity due to the potential for confidentiality, integrity, and availability impacts. No official patch or remediation guidance is currently provided, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability could allow an attacker to execute stored cross-site scripting attacks via CSRF, potentially leading to unauthorized actions performed in the context of an authenticated user. This may impact confidentiality, integrity, and availability of the affected system. However, no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the Quick Event Calendar plugin to trusted users only and avoid clicking on untrusted links while authenticated. Monitor vendor channels for updates and apply patches promptly once released.