WebCalendar version 1.3.0 suffers from reflective and persistent cross site scripting vulnerabilities.