CVE-2026-119176 in CP Multi View Events Calendar Plugin
Summary
by MITRE • 10/30/2026
The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject' parameter in all versions up to, and including, 1.4.43 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The required nonce is localized to any published page carrying the calendar shortcode, making the adddetails endpoint reachable by any authenticated user with Subscriber-level access or above.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The CP Multi View Events Calendar plugin for WordPress contains a critical security flaw identified as Stored Cross-Site Scripting within its event management functionality. This vulnerability affects all versions up to and including 1.4.43, stemming from insufficient input sanitization and output escaping mechanisms when handling the Subject parameter during event creation or modification processes. The core technical failure lies in the application's inability to properly validate or encode user-supplied data before storing it in the database and subsequently rendering it on public-facing pages without appropriate encoding. This lack of robust defensive coding practices allows malicious actors to inject arbitrary JavaScript code that persists within the system's content repository rather than being transient, thereby creating a persistent threat vector for any visitor who views the affected calendar entries.
The operational impact of this vulnerability is significant because it enables authenticated attackers with subscriber-level access or higher privileges to execute arbitrary web scripts in the context of other users' browsers. Unlike reflected cross-site scripting where payload execution requires user interaction with a crafted link, stored XSS persists on the server side and executes automatically whenever an authorized page containing the calendar shortcode is accessed by any visitor. This characteristic amplifies the potential damage as it can lead to session hijacking, credential theft via keyloggers embedded in the injected scripts, defacement of website content, or redirection of users to malicious phishing sites. The requirement for authentication lowers the barrier to entry for attackers compared to unauthenticated vulnerabilities, yet subscriber-level access is often granted broadly and with minimal scrutiny, making this a realistic threat vector against many WordPress installations that utilize community-driven event calendars.
From an industry standards perspective, this vulnerability aligns closely with CWE-79, which classifies Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific nature of the flaw where data is stored and later retrieved for display without proper encoding also relates to CWE-80, a subset focusing on improper neutralization in dynamic content generation. In terms of attack tactics mapped by MITRE ATT&CK, this vulnerability facilitates techniques associated with Collection via Browser Redirects or Credential Access through Keylogging if the injected script captures user input fields. The localization of the required nonce to any published page carrying the calendar shortcode further complicates mitigation efforts because it means that simply restricting access to administrative endpoints is insufficient; attackers can leverage their existing subscriber privileges on standard public pages to trigger the vulnerable adddetails endpoint, effectively bypassing traditional perimeter defenses that focus solely on high-privilege areas.
To mitigate this vulnerability and secure WordPress environments utilizing affected plugins, immediate action must be taken by updating the CP Multi View Events Calendar plugin to a patched version released after 1.4.43 where proper input validation and output escaping have been implemented. Administrators should verify that all instances of user-supplied data are sanitized using appropriate functions such as wp_kses_post or similar context-aware sanitization methods before database insertion, and ensure that output is escaped using esc_html or equivalent encoding techniques when rendering content in HTML contexts. Additionally, implementing a Web Application Firewall can provide an additional layer of defense by detecting and blocking common XSS patterns in HTTP requests. Regular security audits and code reviews focusing on input handling practices are recommended to prevent similar vulnerabilities from being introduced into WordPress plugins and themes in the future.