Full Upgrade: The best way to fix the problem is to perform a full upgrade, downloading the complete 3.6.7 package from the vBulletin Members' Area and following the regular upgrade instructions. This is the only option that will not only fix the XSS issue, but will also apply all the bug fixes made since the release of 3.6.6.
Patch: A second option is to download the patch files either in the Members' Area or attached to this thread and upload them to your web server, overwriting the existing files.
Patch file: 366_patch.zip
Plugin: The plugin built into vBulletin 3.6 allows the problem to be fixed with a simple plugin. The install file for this plugin is also attached to this thread and is the easiest way to fix the problem, as it does not require you to upload any files via FTP. The plugin will be automatically removed when you perform your next full upgrade. You can install the plugin by following the instructions here.
Plugin File: vb_calendar366_css_fix_plugin.xml
This site is not for supporting direct upgrades of vBulletin... you have to go to the official website, have your license updated...
-- please other members, don't fall in the trick of a request... if the guy does not see the attachments, it is because he is not licensed... not us to deal with that
I have put the plugin on for now, full upgrade either later tonight or tomorrow, as I have half a dozen code changes to make and I have to be in the mood.