Multiple cross-site scripting (XSS) vulnerabilities in WebCalendar allow remote attackers to inject arbitrary web script via (1) view_entry.php (2) view_d.php (3) usersel.php (4) datesel.php (5) trailer.php or (6) styles.php as demonstrated using img srg tags.