Stored XSS in CP Multi View Events Calendar Plugin

The CP Multi View Events Calendar plugin for WordPress, in all versions up to and including 1.4.42, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2026-110701. The vulnerability exists due to insufficient input sanitization and output escaping within the CalendarTitle parameter. Attackers can leverage this flaw to inject malicious scripts into calendar views. For successful exploitation, an administrator must have explicitly enabled the 'Allow edition in frontend?' setting, which inadvertently exposes an unauthenticated add endpoint and a publicly accessible nonce to the internet. If exploited, arbitrary JavaScript will execute in the browser of any user viewing the compromised calendar page, potentially leading to session hijacking or unauthorized administrative actions.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of victim browsers. This can lead to the theft of session cookies, administrative account takeover, or the redirection of users to malicious websites. Organizations utilizing this plugin with front-end editing enabled are at high risk of site-wide compromise if an attacker targets high-privileged users.

Recommendation

Update the CP Multi View Events Calendar plugin to the latest version available beyond 1.4.42 to address the lack of input sanitization. In the interim, disable the 'Allow edition in frontend?' feature in the plugin settings to prevent access to the vulnerable endpoint and mitigate the risk of unauthenticated script injection.