Stored Cross-Site Scripting Vulnerability in CP Multi View Events Calendar Plugin for WordPress

CVE-2026-119176

What is CVE-2026-119176?

The CP Multi View Events Calendar plugin for WordPress suffers from a stored cross-site scripting (XSS) vulnerability. This issue arises from the inadequate sanitization and escaping of input provided through the 'Subject' parameter. Authenticated users with subscriber-level access and higher can exploit this vulnerability to inject arbitrary web scripts into pages that will execute when other users access them. The vulnerability is exacerbated by the localization of the required nonce to any published page containing the calendar shortcode, rendering the adddetails endpoint accessible to any authenticated user with proper permissions.

References