CVE-2021-34667: 
WordPress vulnerability analysis and mitigation

The Calendar_plugin WordPress plugin was identified with a Reflected Cross-Site Scripting vulnerability (CVE-2021-34667) affecting versions up to and including 1.0. The vulnerability was discovered and reported by researcher p7e4, with the CVE being created on June 10, 2021. The issue was identified in the plugin's calendar.php file (CVE Mitre).

The vulnerability stems from the improper use of $_SERVER['PHP_SELF'] in the ~/calendar.php file, which allows attackers to inject arbitrary web scripts. The vulnerability has been assigned a CVSS Score of 6.1 (Medium) with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (Wordfence Advisory).

The vulnerability enables attackers to perform Cross-Site Scripting (XSS) attacks, potentially allowing the injection and execution of malicious web scripts in the context of the affected WordPress site (CVE Mitre).

As of the vulnerability disclosure, no patch has been made available for this vulnerability. Users of the Calendar_plugin WordPress plugin should consider alternative calendar plugins or implement additional security controls to prevent XSS attacks (Wordfence Advisory).