11
Yes, 2.1.6 is a dev. version.
But, this morning I performed the same test on eXtCal 2.1.4 and eXtCal 2.1.5, and the same vulnerabilities were found in these versions.
I have not posted this in Zoullou's forum (yet), only submitted it to the bug tracker on SourceForge.