CVE-2026-73827

SOY Calendar contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product...

CVE-2026-78071 Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0

Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar...

CVE-2026-78071

DP Calendar is a Joomla extension by digital-peak.com. Versions 7.0.0 through 10.11.2 are affected by an authenticated, privileged stored XSS . The root cause is that the location title is rendered in a data attribute without proper escaping. Exploitation requires an authenticated user with the c...

CVE-2026-78071 Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0

Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar...

EUVD-2026-67653

Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0 - 10.11.2 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar...

CVE-2026-78070

CVE-2026-78070 affects the DP Calendar Joomla extension (by digital-peak.com), versions 5.5.0 through 10.11.2 . The vulnerability is an authenticated blind SQL injection in the extension's content plugin , triggered when saving an article . Exploitation requires the attacker to hold update permis...

EUVD-2026-67650

Joomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.2 - Saving an article can trigger a blind SQL injection with content plugin, needs update permission for articles...

CVE-2026-78070 Joomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.2

Joomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.2 - Saving an article can trigger a blind SQL injection with content plugin, needs update permission for articles...

CVE-2026-78070 Joomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.2

Joomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.2 - Saving an article can trigger a blind SQL injection with content plugin, needs update permission for articles...

EUVD-2026-67465

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via customer name fields in versions up to and including 2.2. This is due to an authentication bypass where the AddBookingCommand explicitly skips nonce verification...

CVE-2026-6286 Booking for Appointments and Events Calendar <= 2.2 - Unauthenticated Stored Cross-Site Scripting via Customer Name Fields in Booking Submission

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via customer name fields in versions up to and including 2.2. This is due to an authentication bypass where the AddBookingCommand explicitly skips nonce verification...

CVE-2026-77838

SOY Calendar contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product...

EUVD-2026-67577

SOY Calendar contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product...

CVE-2026-77838

SOY Calendar is affected by a cross-site scripting (XSS) vulnerability that allows an arbitrary script to be executed in the web browser of a user who is logging in to the product. The vulnerability is scored 5.4 (MEDIUM) under CVSS v3.0, requiring low privileges and user interaction. No fix vers...

CVE-2026-73827

SOY Calendar contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product...

CVE-2026-73827

SOY Calendar is affected by a cross-site scripting (XSS) vulnerability that allows an arbitrary script to be executed in the web browser of a user who is logging into the product. The vulnerability requires low privileges and active user interaction , with a CVSS 3.0 base score of 5.4 (MEDIUM) an...

EUVD-2026-67576

SOY Calendar contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product...

CVE-2026-81814

Affected versions of Flowintel render calendar event titles using innerHTML. Because those titles are derived from case titles, a user able to create or modify a case title could store HTML or script-capable content that is later interpreted by the browser when another user views the calendar. Th...

CVE-2026-81814 Flowintel Stored XSS in Calendar via Malicious Case Title

Affected versions of Flowintel render calendar event titles using innerHTML. Because those titles are derived from case titles, a user able to create or modify a case title could store HTML or script-capable content that is later interpreted by the browser when another user views the calendar. Th...

CVE-2026-81814

Flowintel is vulnerable to stored XSS in its calendar view. Calendar event titles are derived from case titles and rendered via innerHTML , allowing a user who can create or modify a case title to inject HTML or script-capable content that executes in the browser of another user viewing the calen...