WordPress The Holiday Calendar plugin version 1.11.2 suffers from a cross site scripting vulnerability.