Stored XSS in DPCalendar Free via Event Location Manipulation

DPCalendar Free versions 10.11.2 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability, tracked as CVE-2026-78071. The flaw resides in the handling of the location title field, which is rendered without proper output encoding in default_locations.php. An attacker with Author-level privileges (the minimum role required to create events) can exploit a design flaw where the event publication state is not verified during the edit process. By creating a legitimate-looking event, waiting for administrator approval, and subsequently modifying the event location title with a crafted payload, an attacker can bypass content review. The injected JavaScript, typically using an onmouseover handler, executes in the browser of any user who hovers over the event's location information section. This vulnerability poses a significant risk for account takeover through session cookie theft and unauthorized actions on behalf of site visitors and administrators.

Attack Chain

1. Attacker authenticates to the target Joomla instance as an Author-role user.
2. Attacker creates a benign event with a legitimate location to establish trust and submit for publication.
3. Administrator reviews and publishes the event via the DPCalendar backend.
4. Attacker leverages the lack of state validation in EventController::allowEdit() to modify the published event.
5. Attacker replaces the location title with a malicious payload containing an onmouseover attribute: New Location" onmouseover="[javascript_payload].
6. The payload is stored in the database without server-side sanitization of the double-quote character.
7. A victim (visitor or administrator) views the event page and moves the mouse cursor over the location section.
8. The browser executes the injected JavaScript within the victim's session, enabling credential exfiltration or malicious redirects.

Impact

Successful exploitation allows for persistent stored XSS on public-facing event pages. Impact includes session hijacking via document.cookie exfiltration, which facilitates account takeover, particularly if an administrator views the manipulated event. Because the exploit survives the review process, it enables silent, long-term weaponization of high-traffic sites using DPCalendar.

Recommendation

1. Upgrade DPCalendar Free to version 10.12.0 or later immediately to patch the output encoding flaw.
2. Review event logs for any user accounts holding Author roles that have performed unauthorized edits to already published events.
3. Implement a Content Security Policy (CSP) that restricts inline JavaScript execution to mitigate the impact of stored XSS vulnerabilities.
4. Enable and monitor web server access logs for suspicious input containing HTML event handlers (e.g., onmouseover, onclick, onerror) in URI queries or POST body parameters related to DPCalendar.