According to: http://secunia.com/advisories/23341
"7all has discovered a vulnerability in WebCalendar, which can be exploited by malicious people to conduct cross-site scripting attacks.
Input passed to the "format" parameter in export_handler.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of a vulnerable site.
The vulnerability is confirmed in version 1.0.4. Other versions may also be affected."