EUVD-2026-102785
GHSA-h82p-7v3c-q6xw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach site with frontend editing enabled
-
DeliveryRetrieve public nonce for add endpoint
-
ExploitSubmit event with script in CalendarTitle
-
ExecutionPayload stored unsanitized
-
PersistVictim views injected calendar page
-
ImpactScript executes in victim browser context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that a site administrator has enabled the 'Allow edition in frontend?' option on at least one calendar view in the CP Multi View Events Calendar plugin; this is a non-default setting that exposes the unauthenticated event-add endpoint and a publicly accessible nonce the attacker uses. Given that precondition, no authentication is required (CVSS PR:N) and the payload is injected via the 'CalendarTitle' parameter. The principal limiting factor is this non-default frontend-editing configuration: installs without it enabled are not exposed through the unauthenticated path. A further practical dependency is that a victim (ideally a privileged user) must later browse the injected calendar page for the stored script to fire. |
| Impact | This is a genuine but conditional, lower-tier priority rather than an urgent emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2 HIGH) describes network-reachable, unauthenticated exploitation with a scope change (the injected script executes in victims' browser context, outside the vulnerable component). However, that 'no privileges/no user interaction' profile applies only when a precondition is met: an administrator must have enabled the non-default 'Allow edition in frontend?' option on at least one calendar view, which is what exposes the unauthenticated add endpoint and the publicly accessible nonce. No EPSS score, no CISA KEV listing, and no public POC were provided - so exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC decision data in the input. The signals are internally consistent (stored XSS, CWE-79, scope-changed low-impact confidentiality/integrity), but the headline 'unauthenticated' rating is contingent on a non-default configuration, meaning real-world exploitable deployments are a subset of installs. Net: treat as a routine-to-moderate patch priority - higher where frontend editing is enabled, low where it is not. |
| Exploit ScenarioDerived | On a site where an admin has enabled 'Allow edition in frontend?' for a calendar view, an unauthenticated attacker retrieves the publicly accessible nonce and submits an event through the exposed add endpoint with a malicious script payload in the 'CalendarTitle' parameter. Because input is not sanitized and output is not escaped, the stored script executes in the browser of any user - including administrators - who later views the injected calendar page. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Stored cross-site scripting in the WordPress plugin CP Multi View Events Calendar (CodePeople) in all versions up to and including 1.4.42 lets unauthenticated attackers inject arbitrary JavaScript through the CalendarTitle parameter, which is then rendered without escaping and executes in the browser of any user - including administrators - who later views the poisoned calendar page. Exploitation is conditional on a non-default configuration: a site administrator must have enabled the 'Allow edition in frontend?' option on at least one calendar view, which exposes the unauthenticated event-add endpoint together with a publicly accessible nonce that the attacker uses to submit the malicious title. No public exploit code was identified at the time of analysis and the issue is not listed in CISA KEV, but the 7.2 CVSS score with PR:N (unauthenticated) and scope change (S:C) makes the attack path low-complexity once that frontend-editing setting is active.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - the WordPress.org plugin repository shows a changeset (https://plugins.trac.wordpress.org/changeset/3748683/cp-multi-view-calendar/trunk/DC_MultiViewCal/src/Plugins/jquery.calendar.js) that hardens the calendar title rendering path in plugin trunk, so administrators should upgrade the plugin to the first tagged release that includes that changeset and, until then, verify the plugin's changelog at https://plugins.trac.wordpress.org/log/cp-multi-view-calendar/ for a fixed version rather than assuming 1.4.42 is the last affected build. The most effective immediate compensating control is to disable the 'Allow edition in frontend?' option on every calendar view, since without it the unauthenticated add endpoint and its nonce are not exposed; the trade-off is that legitimate front-end event submission by visitors stops working. If front-end editing must remain enabled, the vulnerability cannot be fully mitigated from configuration alone, so pair it with a WAF or reverse-proxy rule that rejects POST bodies to the plugin's datafeed endpoint containing script markup in the CalendarTitle field, guarding against common encodings; this is evasion-prone and should be considered a stopgap. Because the stored payload only fires when a user opens the affected calendar page, also review existing calendar entries for injected script content after patching and ask privileged users to avoid browsing untrusted calendar views until the fixed build is deployed; there is no vendor-released patch identified at the time of analysis beyond the trunk changeset, and no public exploit code was identified at that time, so this is a conditional, lower-tier priority rather than an urgent emergency.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e. cross-site scripting) in the CP Multi View Events Calendar WordPress plugin, published by CodePeople and tracked in CPE as cpe:2.3:a:codepeople:cp_multi_view_events_calendar:*:*:*:*:*:*:*:* with no version bounds, meaning every release through 1.4.42 is in scope. The plugin renders its calendar views through a jQuery-based front-end component (DC_MultiViewCal/src/Plugins/jquery.calendar.js) whose data is supplied by an AJAX datafeed handler (php/datafeed.php). The CalendarTitle parameter submitted to that datafeed is stored without adequate sanitization and then written back into the calendar markup without output escaping, so a submitted title is treated as HTML/JavaScript rather than inert text when the page is rendered (the changeset fixes specifically touch jquery.calendar.js line 2689, the rendering path). The vulnerable datafeed endpoint is only reachable by unauthenticated users when an administrator has turned on the 'Allow edition in frontend?' setting for at least one calendar view, which also publishes the nonce needed to authorize the add request; the plugin bootstrap in cp-multi-view-calendar.php line 32 registers these front-end endpoints. The CVSS scope change (S:C) reflects that the injected script executes in the victim's browser session under the target site's origin, where it can act with that user's privileges, while the low confidentiality and integrity impact ratings (C:L/I:L) and the absence of an availability impact keep the assessed severity moderate rather than critical.
Know when Cp Multi View Events Calendar gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Unauthenticated add endpoint (PR:N) is network-reachable with simple requests (AC:L); stored XSS runs in victims' browsers across a trust boundary (S:C) with limited C/I impact and no availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'CalendarTitle' parameter in all versions up to, and including, 1.4.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires that an administrator has enabled the "Allow edition in frontend?" option on at least one calendar view, which exposes the unauthenticated add endpoint and a publicly accessible nonce.
Executive ViewAI
The CP Multi View Events Calendar plugin for WordPress, used by organizations to manage event listings, contains a stored cross-site scripting flaw affecting all versions up to 1.4.42. Under a non-default configuration enabling frontend event editing, unauthenticated attackers can inject malicious JavaScript that executes in the browsers of site administrators and other users, potentially leading to session hijacking, site takeover, or data theft. Leadership should prioritize remediation because a compromised administrative account could result in full control of the WordPress site, impacting reputation and exposing sensitive data.
Disable the 'Allow edition in frontend?' option to remove the unauthenticated attack vector; if required, restrict event-add endpoint access via WAF or IP allowlisting; implement virtual patching with XSS filtering rules for the CalendarTitle parameter; enforce a strict Content Security Policy (CSP) to block inline script execution; monitor and sanitize all user-supplied input; and audit calendar content for injected scripts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB