Stored Cross-Site Scripting Vulnerability in CP Multi View Events Calendar Plugin by WordPress
CVE-2026-110701

7.2HIGH

Key Information:

Vendor

WordPress
Status
Cp Multi View Events Calendar
Vendor
CVE Published:
16 October 2026

What is CVE-2026-110701?

The CP Multi View Events Calendar plugin for WordPress contains a vulnerability that allows unauthenticated attackers to perform Stored Cross-Site Scripting via the 'CalendarTitle' parameter. This issue arises from insufficient input sanitization and output escaping in all versions up to and including 1.4.42. If the 'Allow edition in frontend?' option is enabled by an administrator on any calendar view, it exposes a publicly accessible endpoint and nonce, enabling attackers to inject arbitrary web scripts into pages. These scripts can execute as users access affected pages, presenting significant security risks.

Affected Version(s)

CP Multi View Events Calendar 0 <= 1.4.42

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/cp-multi-view-...
https://plugins.trac.wordpress.org/browser/cp-multi-view-...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Supakiad S. (m3ez)
.