EIP-2026-114205

The provided text describes a cross-site scripting (XSS) vulnerability in WP Ajax Calendar 1.0, where user-supplied input via the 'y' parameter is not properly sanitized. This allows arbitrary script execution in the context of the affected site.