XSS in Digital-Peak.com Dp Calendar Extension For Joomla
CVE-2026-78071
Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0 - 10.11.2 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar.
Vulnerability class: XSS (Cross-Site Scripting)
Affected products
- Digital-peak.com Dp Calendar Extension For Joomla — versions 7.0.0-10.11.2
Weakness classification (CWE)
References
- security@joomla.org (product)