By abusing the iCalendar import functionality, a logged-in editor could take the whole site offline, make the server reach into the internal network and read calendar files off disk (SSRF), and store XSS.
Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role).
Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role.
Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only available to the Manager role).