EUVD-2026-67653
GHSA-32gf-548r-6r9c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:X/V:X/RE:X/U:X
PR:H reflects the required DPCalendar create role; UI:R because a victim must load the affected page; S:C for cross-user browser impact.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0 - 10.11.2 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar.
AnalysisAI
Stored XSS in DP Calendar for Joomla (versions 7.0.0 through 10.11.2) allows authenticated users holding the DPCalendar 'create' permission to inject persistent malicious script by submitting an unsanitized Location title, which is rendered into an HTML data attribute without output encoding. Any Joomla site visitor who subsequently loads a calendar page containing the poisoned entry will execute the attacker-controlled payload in their browser, enabling session hijacking or unauthorized actions on their behalf. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Joomla account with the 'create' permission granted specifically within the DP Calendar (DPCalendar) extension - this is a non-default, extension-scoped role separate from standard Joomla user or administrator roles. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 7.5 reflects a bounded risk profile: AV:N confirms the attack is network-reachable, but PR:H constrains the exploitable population to users who hold the 'create' permission specifically within the DPCalendar extension - a non-default, application-scoped privilege that most sites grant only to trusted content editors or administrators. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update DP Calendar to a version beyond 10.11.2 per the vendor's guidance at https://joomla.digital-peak.com/products/dpcalendar; an exact patched release version is not confirmed in the available intelligence (see Confidence Notes). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Joomla instances running DP Calendar 7.0.0-10.11.2 and immediately restrict the 'create' permission to trusted administrators only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
SQL injection in the DPCalendar extension for Joomla lets remote unauthenticated attackers inject arbitrary SQL through
Blind SQL injection in the DP Calendar Joomla extension (versions 5.5.0 through 10.11.2) enables authenticated users hol
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today