Executive brief
DP Calendar is a popular Joomla extension for managing events and calendars. An authenticated user with calendar creation permissions can inject malicious code through the location title field, which is rendered without proper escaping in HTML attributes, allowing stored cross-site scripting (XSS) attacks that could compromise other administrators' browsers and accounts.
Technical details
This is a stored XSS vulnerability in DP Calendar where the location title is rendered directly into a data attribute without HTML entity escaping, allowing arbitrary JavaScript injection. The vulnerability requires authentication and the ability to create locations in DPCalendar (specific create permission required). An attacker with these privileges can inject malicious JavaScript that persists in the database and executes in the browsers of any user viewing the affected location, potentially leading to session hijacking or administrative account compromise. The vulnerability affects versions 7.0.0 through 8.19.5 and 9.0.0 through 10.12.0.
Affected products
- Digital Peak DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0
Timeline
- 2026-08-28: disclosed