39 matches found
CVE-2026-119176
The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject' parameter in all versions up to, and including, 1.4.43 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2026-119176 CP Multi View Events Calendar <= 1.4.43 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Subject' Parameter
The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject' parameter in all versions up to, and including, 1.4.43 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
EUVD-2026-114258
The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject' parameter in all versions up to, and including, 1.4.43 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2026-119176 CP Multi View Events Calendar <= 1.4.43 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Subject' Parameter
The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject' parameter in all versions up to, and including, 1.4.43 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2026-119176
The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 1.4.43 . The root cause is insufficient input sanitization and output escaping involving the 'Subject' parameter . Authenticated attackers with Subscriber-leve...
CVE-2026-119176: codepeople CP Multi View Events Calendar: The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject'…
The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject' parameter in all versions up to, and including, 1.4.43 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
WordPress CP Multi View Events Calendar plugin <= 1.4.42 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Supakiad S. m3ez in WordPress Plugin CP Multi View Event Calendar versions = 1.4.42...
CVE-2026-110701
The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'CalendarTitle' parameter in all versions up to, and including, 1.4.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
CVE-2026-110701 CP Multi View Events Calendar <= 1.4.42 - Unauthenticated Stored Cross-Site Scripting via 'CalendarTitle' Parameter
The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'CalendarTitle' parameter in all versions up to, and including, 1.4.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
EUVD-2026-102785
The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'CalendarTitle' parameter in all versions up to, and including, 1.4.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
CVE-2026-110701
The CP Multi View Events Calendar plugin for WordPress (versions up to and including 1.4.42 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the 'CalendarTitle' parameter. The root cause is insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitra...
CVE-2026-110701 CP Multi View Events Calendar <= 1.4.42 - Unauthenticated Stored Cross-Site Scripting via 'CalendarTitle' Parameter
The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'CalendarTitle' parameter in all versions up to, and including, 1.4.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
CVE-2026-110701: Improper Neutralization of Input During Web Page Generation
The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'CalendarTitle' parameter in all versions up to, and including, 1.4.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
PT-2026-115496
Name of the Vulnerable Software and Affected Versions CP Multi View Events Calendar versions prior to 1.4.43 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS, a technique where malicious scripts are...
WordPress CP Multi View Events Calendar Cross-Site Script Vulnerability
WordPress CP Multi View Events Calendar versions 1.4.42 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the CalendarTitle parameter, which may lead to storage-based cross-site scripting attacks. Unverified...
CVE-2026-76060
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec, allowing any authenticated user with View Events permission to execute arbitrary operati...
PhoenixStorybook: Unbounded atom creation from LiveView event params (atom-table DoS)
Summary An attacker who can deliver psb-assign, psb-toggle, psb-set-theme, upper-tab-navigation, lower-tab-navigation, playground-change, or playground-toggle LiveView events to a mounted Phoenix Storybook playground can flood the BEAM atom table with attacker-controlled strings, permanently...
CVE-2026-27470
ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-order SQL Injection vulnerability in the web/ajax/status.php file within the getNearEvents function. Event field values specifically Name a...
XWiki Contrib Mocca Calendar Application Cross-site Scripting Vulnerability
XWiki Contrib Mocca Calendar Application is an open source XWiki plugin for XWiki Contrib. A cross-site scripting vulnerability exists in XWiki Contrib Mocca Calendar Application versions prior to 2.15, which stems from cross-site scripting in the title of the View Events page...