CP Multi View Events Calendar <= 1.4.43 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Event Color and Description
- ID
- WPSEC-2026-2154
- Plugin
- CP Multi View Events Calendar (cp-multi-view-calendar)
- Affected
- all versions before 1.4.44
- Remediation
- Update to 1.4.44 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-30
- Attack surface
- CP Multi View Events Calendar on WPSec AttackSurface
- Fix released
- Published
Description
The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the event 'colorvalue' and 'Description' parameters in all versions up to, and including, 1.4.43, due to insufficient input sanitization and output escaping. The color value only passed through sanitize_text_field(), which does not remove quotes, and was then placed into style attributes in the calendar markup. The description could be HTML-entity-decoded and inserted into the list view without escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user views the calendar.
References
- https://wpsec.com/vuln/WPSEC-2026-2154/
- https://plugins.svn.wordpress.org/cp-multi-view-calendar/tags/1.4.44/
- https://wordpress.org/plugins/cp-multi-view-calendar/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS