Input validation vulnerability in Simple Calendar – Google Calendar Plugin 3.2.6

The Simple Calendar – Google Calendar Plugin is a plugin for WordPress websites that is vulnerable to a type of attack called Stored Cross-Site Scripting. This type of attack can be used by someone with ‘contributor-level’ or higher permissions, to inject malicious web scripts into pages. This means that when a user visits an infected page, the malicious scripts will be triggered and could be used to steal information or cause harm. To protect against this type of attack, all versions up to and including 3.2.6 of the plugin should be updated.