CVE-2013-1470: Cross-site scripting (XSS) vulnerability in calendar/index.php in the Calendar plugin in Geeklog before 1.8...

Security readout for executives and security teams

This is a cross-site scripting issue in Geeklog's Calendar plugin. A remote attacker could inject script or HTML through the calendar_type parameter, potentially causing malicious content to run in a user's browser. The sources identify fixed Geeklog release lines, but do not show current active exploitation. Exposure is most likely on older Geeklog sites that enabled the Calendar plugin and still run versions before 1.8.2sr1 or affected 2.0.0 prerelease builds. Internet-facing community, CMS, or intranet portals using Geeklog should be checked first. Treat this as a moderate legacy web-application risk. It is unlikely to justify emergency action without exposure evidence, but any internet-facing affected Geeklog site should be upgraded or formally retired. Mitigation focus: Upgrade Geeklog to 1.8.2sr1 or later, or 2.0.0rc2 or later for the 2.0 branch.; Review the Geeklog vendor advisory for upgrade guidance and any branch-specific notes.; Prioritize remediation for public-facing Geeklog instances with the Calendar plugin enabled..

Prepared

Jun 14, 2026, 14:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.