Skip to content
Threat Feed
Subscribe

Vendor

Digital Peak

1 brief RSS
high advisory

Stored XSS in DPCalendar Free via Event Location Manipulation

DPCalendar Free versions 10.11.2 and earlier contain a stored XSS vulnerability in the location title field, allowing an Author-role user to bypass content moderation and execute arbitrary JavaScript in the browsers of site visitors.

DPCalendar Free web-vulnerability xss cve-2026-78071
1r 1t 1c