Reflected XSS Vulnerability in Calendar Plus by Webjunk

CVE-2025-53350

What is CVE-2025-53350?

A Cross-site Scripting (XSS) vulnerability exists in the Calendar Plus plugin by Webjunk. Specifically, this issue arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that can be executed in the user's browser. This could lead to unauthorized access and data theft. The affected versions include all prior to or equal to 1.2.4. It's crucial for users of the Calendar Plus plugin to apply necessary updates and implement security measures to protect their web applications from such vulnerabilities.

References