Cp Multi View Events Calendar
Monthly
Stored cross-site scripting in the WordPress plugin CP Multi View Events Calendar (CodePeople) in all versions up to and including 1.4.42 lets unauthenticated attackers inject arbitrary JavaScript through the CalendarTitle parameter, which is then rendered without escaping and executes in the browser of any user - including administrators - who later views the poisoned calendar page. Exploitation is conditional on a non-default configuration: a site administrator must have enabled the 'Allow edition in frontend?' option on at least one calendar view, which exposes the unauthenticated event-add endpoint together with a publicly accessible nonce that the attacker uses to submit the malicious title. No public exploit code was identified at the time of analysis and the issue is not listed in CISA KEV, but the 7.2 CVSS score with PR:N (unauthenticated) and scope change (S:C) makes the attack path low-complexity once that frontend-editing setting is active.
Stored cross-site scripting in the WordPress plugin CP Multi View Events Calendar (CodePeople) in all versions up to and including 1.4.42 lets unauthenticated attackers inject arbitrary JavaScript through the CalendarTitle parameter, which is then rendered without escaping and executes in the browser of any user - including administrators - who later views the poisoned calendar page. Exploitation is conditional on a non-default configuration: a site administrator must have enabled the 'Allow edition in frontend?' option on at least one calendar view, which exposes the unauthenticated event-add endpoint together with a publicly accessible nonce that the attacker uses to submit the malicious title. No public exploit code was identified at the time of analysis and the issue is not listed in CISA KEV, but the 7.2 CVSS score with PR:N (unauthenticated) and scope change (S:C) makes the attack path low-complexity once that frontend-editing setting is active.