The my-calendar plugin before 3.1.10 for WordPress has XSS.
Published August 28, 2019.
My Calendar Project My Calendar