DP Calendar vulnerabilities

Joomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.2. Saving an article can trigger a blind SQL injection with content plugin, needs update permission for articles.

The DP Calendar extension for Joomla (digital-peak.com) in versions 7.0.0-8.19.5 and 9.0.0-10.12.0 contains an authenticated, privileged stored XSS vulnerability. The location title is rendered in a data attribute without escaping, leading to XSS; create permission in DPCalendar is required.

The Joomla extension DP Calendar versions 8.18.0 through 10.11.2 is vulnerable to unauthenticated blind SQL injection. An attacker can send crafted queries without authentication.