CVE-2026-110701 in CP Multi View Events Calendar Plugin
Summary
by MITRE • 10/16/2026
The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'CalendarTitle' parameter in all versions up to, and including, 1.4.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires that an administrator has enabled the "Allow edition in frontend?" option on at least one calendar view, which exposes the unauthenticated add endpoint and a publicly accessible nonce.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/16/2026
The CP Multi View Events Calendar plugin for WordPress contains a critical security vulnerability identified as Stored Cross-Site Scripting within its core functionality. This flaw affects all versions up to and including 1.4.42, stemming from insufficient input sanitization and output escaping mechanisms when handling the CalendarTitle parameter. The nature of this vulnerability allows unauthenticated attackers to inject arbitrary web scripts into database-stored content, which are subsequently executed in the browsers of users who view pages containing the malicious payload. This represents a significant risk as it bypasses standard authentication requirements for certain administrative features, leveraging misconfigurations or default settings that expose sensitive endpoints to public access.
The technical root cause lies in the plugin's handling of user-supplied data during calendar creation and modification processes. Specifically, when an administrator enables the Allow edition in frontend option on at least one calendar view, the system exposes an unauthenticated add endpoint along with a publicly accessible nonce. This configuration effectively lowers the barrier for exploitation by allowing external actors to interact directly with the backend logic without valid session credentials or proper authorization tokens. The lack of rigorous validation and encoding when processing the CalendarTitle parameter means that malicious JavaScript code can be embedded into calendar titles, which are then rendered in HTML contexts where scripts execute automatically upon page load.
From an operational impact perspective, this vulnerability enables a wide range of attacks against end-users who interact with affected calendars. Attackers can steal session cookies, hijack user sessions, deface websites, or redirect users to malicious sites designed for phishing or malware distribution. Since the script is stored in the database, every subsequent visit by any authenticated administrator or potentially other authorized viewers triggers the execution of the injected code, amplifying the blast radius beyond a single interaction. This persistent nature distinguishes it from reflected XSS attacks and makes remediation more complex as the malicious content remains active until manually removed from the database.
Industry standards classify this issue under CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting, specifically within the Stored variant where persistence is achieved through backend storage. In terms of tactical mapping to the MITRE ATT&CK framework for enterprise security, this vulnerability aligns with T1059 Command and Control scripting techniques such as JavaScript or HTML-based injection used for initial access and subsequent credential harvesting via T1539 Steal Web Session Cookie. The exploitation path also reflects weaknesses in Access Control particularly regarding improper enforcement of authentication requirements on administrative functions exposed through frontend interfaces, which correlates to CWE-284 Improper Access Control.
Mitigation strategies must prioritize immediate remediation by updating the CP Multi View Events Calendar plugin to a version that addresses these sanitization and escaping deficiencies if an official patch is available from the vendor. In environments where updates are delayed or unavailable, administrators should disable the Allow edition in frontend option across all calendar views to remove exposure of the unauthenticated add endpoint. Additionally implementing strict Content Security Policy headers can help mitigate the impact by restricting script execution sources although this serves as a compensating control rather than a fix for the underlying code flaw. Regular security audits and input validation testing on WordPress plugins are essential to prevent similar vulnerabilities arising from inadequate handling of user inputs in dynamic web applications.