SZB-7d1a4e55c5
EUVD-2026-114258: CP Multi View Events Calendar stored XSS reported in WordPress plugin
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- CodePeople
- Product
- CP Multi View Events Calendar
- First seen
Summary
The EUVD listing (CVSS 6.4) says the CP Multi View Events Calendar WordPress plugin is vulnerable to stored cross-site scripting via the 'Subject' parameter in all versions up to and including 1.4.43. The listing is the only source cited.
If you use CodePeople
Update the CP Multi View Events Calendar plugin to a version later than 1.4.43
Review event subjects for injected script
Limit editor roles to trusted users until patched
What the sources say 1
· Mastodon: “The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject' parameter in all versions up to, and including, 1.4.43 due to insufficient input sanitization and output escaping...” Source