Authenticated Stored XSS Vulnerability in DP Calendar by digital-peak.com
CVE-2026-78071

7.5HIGH

Key Information:

Vendor

Digital-peak.com

Status
Dp Calendar Extension For Joomla
Vendor
CVE Published:
28 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-78071?

A vulnerability exists in DP Calendar, a Joomla extension developed by digital-peak.com, where an authenticated user with 'create' permissions can leverage stored XSS through the location title feature. This flaw occurs because the location title is rendered in a data attribute without proper escaping, leading to potential malicious script execution in the user's browser. It is crucial for admins to apply patches or mitigations to secure their Joomla environments against this exploit.

Affected Version(s)

DP Calendar extension for Joomla 7.0.0-10.11.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-78071
Created by toanln-cov

References

https://joomla.digital-peak.com/products/dpcalendar
product

CVSS V4

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Toan Le
.