A vulnerability has been discovered in the todoyu third party library calendar, which can be exploited by malicious people to conduct cross-site scripting attacks (read the report).
Input passed via the "lang" parameter to lib/js/jscalendar/php/test.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Although the criticality level is classified as low, please update your todoyu installation to version 2.0.9.

Download the latest version of todoyu