# CVE-2026-119176: CP Multi View Events Calendar stored cross-site scripting

Source: https://junglewise.ai/threats/cve-2026-119176-the-cp-multi-view-events-calendar-plugin-for-wordpress-is  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-119176 · Severity: medium · CVSS 6.4 · Published 2026-10-30

The CP Multi View Events Calendar plugin for WordPress allows authenticated users to inject malicious scripts into event details that execute when other users view the calendar. An attacker with basic subscriber-level access can craft a malicious event subject that compromises other users' accounts or steals their session data without any special interaction.

Vendors: [Crocoblock](https://junglewise.ai/threats/vendors/crocoblock).

## Quick answers

**Is CVE-2026-119176 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119176 being exploited in the wild.

**How severe is CVE-2026-119176?** Medium severity, with a CVSS score of 6.4, published 30 October 2026.

**Which products and versions are affected?** Crocoblock CP Multi View Events Calendar up to and including 1.4.43.

**Is there a fix for CVE-2026-119176?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-119176 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-119176?** Check whether you run Crocoblock CP Multi View Events Calendar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Stored XSS in the 'Subject' parameter of the CP Multi View Events Calendar plugin due to insufficient input sanitization and output escaping. The vulnerability requires authentication at subscriber level or above but affects any user who views a page containing the calendar shortcode; the nonce protection is localized to published pages, making the adddetails endpoint reachable by all authenticated subscribers.

## Affected products

- Crocoblock CP Multi View Events Calendar up to and including 1.4.43

## Timeline

- 2026-10-30: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/cp-multi-view-calendar/tags/1.4.43/DC_MultiViewCal/src/Plugins/jquery.calendar.js](https://plugins.trac.wordpress.org/browser/cp-multi-view-calendar/tags/1.4.43/DC_MultiViewCal/src/Plugins/jquery.calendar.js)
- [https://plugins.trac.wordpress.org/browser/cp-multi-view-calendar/tags/1.4.43/DC_MultiViewCal/src/Plugins/jquery.calendar.js](https://plugins.trac.wordpress.org/browser/cp-multi-view-calendar/tags/1.4.43/DC_MultiViewCal/src/Plugins/jquery.calendar.js)