CVE-2026-78071 — Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0

CVE-2026-78071

Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0 PUBLISHED

Description (CNA)

Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar.

Affected (CNA)

Vendor / product	Versions
digital-peak.com / DP Calendar extension for Joomla	affected 7.0.0-8.19.5; affected 9.0.0-10.12.0

CWE

CWE-79

References

https://joomla.digital-peak.com/products/dpcalendar

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.