Cp Multi View Event Calendar EUVD-2026-15750

Although no CVSS vector or EPSS score has been published, the combination of available signals presents a moderate-to-high real-world risk. Stored XSS vulnerabilities typically carry CVSS base scores of 6.1 to 8.8 depending on attack vector (network vs. adjacent network), required privileges (none vs. low), and user interaction (required vs. not required). The plugin's widespread use in WordPress environments and its focus on public-facing event calendars suggest a network attack vector with minimal complexity and no privilege requirements, implying higher exploitability. The absence of KEV designation does not diminish risk—it indicates either recent disclosure or low public exploit availability rather than low technical merit. The lack of a published POC may reflect responsible disclosure practices rather than exploit difficulty. Organizations should treat this as a priority vulnerability pending vendor patch confirmation, particularly if the plugin is exposed on public-facing websites.

An attacker with access to create or edit calendar events (either through a public submission form if enabled, or by compromising a low-privilege WordPress account) injects a malicious JavaScript payload into an event title or description field. When administrators or site visitors view the calendar, the stored XSS payload executes in their browsers, allowing the attacker to steal WordPress authentication cookies, redirect administrators to a credential harvesting page, or inject a malware redirect into the calendar widget. The attack is particularly effective because calendar pages are often trusted by site administrators and may be accessed frequently, maximizing exposure.