CVE-2026-78071
HighCVSS 7.5Summary
Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0 - 10.11.2 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar.
Risk Assessment
The risk includes execution of malicious script in the victim's browser, potentially leading to session theft or other attacks.
Recommendation
Update DP Calendar to a version later than 10.11.2 or apply a security patch.
Other vulnerabilities in DP Calendar
See all- CVE-2026-78070Medium
Joomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.2. Saving an article can trigger a blind SQL injection with content plugin, needs update permission for articles.
- CVE-2026-57831High
The Joomla extension DP Calendar versions 8.18.0 through 10.11.2 is vulnerable to unauthenticated blind SQL injection. An attacker can send crafted queries without authentication.
Original NVD description (English source)
Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0 - 10.11.2 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar.