CVE-2026-78071
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
The DP Calendar extension for Joomla (digital-peak.com) in versions 7.0.0-8.19.5 and 9.0.0-10.12.0 contains an authenticated, privileged stored XSS vulnerability. The location title is rendered in a data attribute without escaping, leading to XSS; create permission in DPCalendar is required.
Risk Assessment
A user with create permission can store a malicious script that executes in other users' browsers. This can lead to session theft or actions performed on behalf of victims.
Recommendation
Update DP Calendar to a version later than 8.19.5 (for the 8.x branch) or later than 10.12.0 (for the 10.x branch). Restrict content creation permissions to trusted users only.
Other vulnerabilities in DP Calendar
See all- CVE-2026-78070Medium
Joomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.2. Saving an article can trigger a blind SQL injection with content plugin, needs update permission for articles.
- CVE-2026-57831High
The Joomla extension DP Calendar versions 8.18.0 through 10.11.2 is vulnerable to unauthenticated blind SQL injection. An attacker can send crafted queries without authentication.
Original NVD description (English source)
Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS