Multiple cross-site scripting (XSS) vulnerabilities in ActiveCalendar 1.2.0 allow remote attackers to inject arbitrary web script or HTML via the css parameter to (1) flatevents.php (2) js.php (3) mysqlevents.php (4) m_2.php (5) m_3.php (6) m_4.php (7) xmlevents.php (8) y_2.php or (9) y_3.php in data/.