CVE-2026-14827 is a Cross-Site Scripting (CWE-79) vulnerability in the Calendar WordPress plugin. The flaw arises from improper escaping of user-supplied event fields before rendering them inside HTML attributes on public pages. This allows users with Contributor privileges to inject malicious JavaScript code that executes in the context of other users viewing the calendar. The vulnerability affects versions prior to 1.3.18, though no explicit affected versions were provided. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required (Contributor role), user interaction required, and impacts confidentiality, integrity, and availability with high severity.

Successful exploitation enables users with Contributor role to execute arbitrary JavaScript in the browsers of calendar viewers. This can lead to theft of sensitive information, session hijacking, or other malicious actions performed in the context of the affected website. The vulnerability affects the confidentiality, integrity, and availability of the affected system as indicated by the CVSS score.

No official patch or remediation level has been confirmed at this time. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor role permissions if possible and avoid accepting untrusted input in event fields. Monitor vendor channels for updates and apply patches promptly once released.