CVE-2026-110701: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in codepeople CP Multi View Events Calendar

CVE-2026-110701 is a stored cross-site scripting vulnerability in the CP Multi View Events Calendar WordPress plugin affecting all versions up to and including 1.4.42. The flaw is due to improper neutralization of input in the 'CalendarTitle' parameter, allowing unauthenticated attackers to inject arbitrary web scripts that execute when users access the affected pages. Successful exploitation depends on an administrator enabling frontend editing, which exposes an unauthenticated add endpoint and a publicly accessible nonce, facilitating script injection.

An attacker can inject persistent malicious scripts into calendar pages, which execute in the context of users visiting those pages. This can lead to information disclosure and limited integrity impact. The vulnerability does not affect availability. Since the attack requires no privileges and no user interaction, it poses a significant risk if the frontend editing option is enabled.

No official patch or fix is currently documented. Users should verify the vendor advisory for updates. As a temporary mitigation, administrators should disable the 'Allow edition in frontend?' option to prevent exposure of the unauthenticated add endpoint and nonce, thereby mitigating the attack vector.