CVE-2026-78071: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in digital-peak.com DP Calendar extension for Joomla

This vulnerability (CVE-2026-78071) is an authenticated, privileged stored XSS in the DP Calendar Joomla extension. Specifically, the location title field is not properly escaped when rendered in a data attribute, enabling cross-site scripting attacks. The affected versions are 7.0.0 to 8.19.5 and 9.0.0 to 10.12.0. Exploitation requires the attacker to have create permissions within DPCalendar. The CVSS 4.0 base score is 7.5, indicating high severity. No vendor advisory or patch information is provided in the input data.

An attacker with create permissions in the DP Calendar extension can inject malicious scripts via the location title field, leading to stored XSS. This can result in the execution of arbitrary scripts in the context of the victim's browser with high impact on confidentiality and integrity, and low impact on availability. The vulnerability requires authenticated access with elevated privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict create permissions to trusted users only to reduce risk. Monitor official digital-peak.com or Joomla advisories for updates and patches addressing this vulnerability.