{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3acodepeoplecp_multi_view_events_calendarwordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:codepeople:cp_multi_view_events_calendar:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-110701"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["CP Multi View Events Calendar (\u003c= 1.4.42)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["CodePeople"],"content_html":"\u003cp\u003eThe CP Multi View Events Calendar plugin for WordPress, in all versions up to and including 1.4.42, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2026-110701. The vulnerability exists due to insufficient input sanitization and output escaping within the CalendarTitle parameter. Attackers can leverage this flaw to inject malicious scripts into calendar views. For successful exploitation, an administrator must have explicitly enabled the 'Allow edition in frontend?' setting, which inadvertently exposes an unauthenticated add endpoint and a publicly accessible nonce to the internet. If exploited, arbitrary JavaScript will execute in the browser of any user viewing the compromised calendar page, potentially leading to session hijacking or unauthorized administrative actions.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of victim browsers. This can lead to the theft of session cookies, administrative account takeover, or the redirection of users to malicious websites. Organizations utilizing this plugin with front-end editing enabled are at high risk of site-wide compromise if an attacker targets high-privileged users.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpdate the CP Multi View Events Calendar plugin to the latest version available beyond 1.4.42 to address the lack of input sanitization. In the interim, disable the 'Allow edition in frontend?' feature in the plugin settings to prevent access to the vulnerable endpoint and mitigate the risk of unauthenticated script injection.\u003c/p\u003e\n","date_modified":"2026-10-16T08:25:30Z","date_published":"2026-10-16T08:25:30Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-110701/","summary":"The CP Multi View Events Calendar plugin for WordPress contains a Stored Cross-Site Scripting vulnerability allowing unauthenticated attackers to inject arbitrary web scripts via the CalendarTitle parameter.","title":"Stored XSS in CP Multi View Events Calendar Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-110701/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:codepeople:cp_multi_view_events_calendar:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}