Live › vulnerability › CVE-2026-110701
Go to dashboardThe CP Multi View Events Calendar plugin for WordPress up to and including 1.4.42 does not sanitize the CalendarTitle parameter, so unauthenticated visitors can store scripts that run in the browser of anyone who opens an affected page. An attacker can run script as site visitors or administrators, for example to steal sessions or act on their behalf.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the CP Multi View Events Calendar plugin at version 1.4.42 or earlier are exposed, but only where an administrator has turned on the "Allow edition in frontend?" option for at least one calendar view, since that option exposes the unauthenticated add endpoint. Sites that have the plugin installed without that option enabled, or that do not run the plugin, can skip it.
No product ranges from the sources yet.
wp plugin get cp-multi-view-event-calendar --field=version if the sources' slug matches1.4.42 once a patched release is available; the sources do not name the fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'CalendarTitle' parameter in all versions up to, and including, 1.4.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires that an administrator has enabled the "Allow edition in frontend?" option on at least one calendar view, which exposes the unauthenticated add endpoint and a publicly accessible nonce.
This page as .md · .json · in your agent: get_signal("CVE-2026-110701")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.