CP MultiView Calendar CVE-2026-119176

Requires an authenticated WordPress account with Subscriber-level access or above, and at least one published page containing the calendar shortcode (which causes the required nonce to be localized to that page, making the adddetails endpoint reachable by any such authenticated user). The attack targets the 'Subject' parameter, which lacks sufficient input sanitization and output escaping. Exploitation is limited by the need for valid Subscriber credentials (so sites that disable open registration or restrict Subscriber creation are less exposed) and by the stored nature requiring a victim to subsequently view the injected calendar page; no user interaction is needed from the attacker side, and no special non-default configuration beyond having the calendar shortcode published is required.

This is a moderate-severity stored XSS (CVSS 6.4) whose real-world urgency sits well below critical, consistent with the vuln.today 'this_month' decision label rather than an act-now priority. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N indicates network-reachable, low-complexity exploitation requiring low privileges (PR:L), meaning an authenticated Subscriber-level account is needed - not an unauthenticated attack. The scope-change (S:C) and C:L/I:L impacts reflect that injected script executes in the browser of other users, including potentially higher-privileged admins, which is the primary risk driver. No EPSS score and no KEV listing were provided in the input, and there is no CISA KEV entry, so there is no evidence of active exploitation. The references point to the Wordfence advisory, the vulnerable source lines, and a WordPress.org trac changeset (the fix) - but none is a working exploit, so no public exploit code is confirmed. The main caveat: although PR is low, the Subscriber barrier plus the need for a published page carrying the calendar shortcode limits mass exploitation, making this more suited to scheduled patching than emergency response.

An attacker registers or obtains a Subscriber-level account on a WordPress site running the plugin, then uses the nonce localized to any public page bearing the calendar shortcode to reach the adddetails endpoint and submit an event whose 'Subject' field contains a malicious script. The payload is stored and later executes in the browser of any user who views the injected calendar page - including administrators - enabling session/cookie theft or admin-context actions. No public working exploit was identified at time of analysis; exploitation requires only Subscriber access and low attack complexity.