CVE-2026-78071

DPCalendar, a calendar extension for Joomla by Digital Peak, stores calendar location titles and later renders them inside an HTML data attribute without escaping, allowing injected markup to break out of the attribute. An authenticated user who holds the DPCalendar create permission can save a maliciously crafted location title, and the payload executes as JavaScript in the browsers of any user who views a page that displays that location. Successful exploitation lets the attacker run script in another user's Joomla session, enabling actions within that user's privileges such as content manipulation or session token theft, while the CVSS 4.0 score of 7.5 (high) reflects the privileged access requirement and high confidentiality/integrity impact. Affected deployments are Joomla sites running DPCalendar 7.0.0 through 8.19.5 or 9.0.0 through 10.12.0. No public proof-of-concept exists, the flaw is not in the CISA KEV catalog, and EPSS puts 30-day exploitation probability at only 0.3%, so no exploitation is currently known.

What to do: Update DPCalendar to a release newer than 10.12.0 (i.e., the fixed version published in the Digital Peak/Joomla advisory). As interim mitigation, limit DPCalendar create permission to trusted users only, since exploiting the flaw requires that privilege, and audit existing calendar location titles for embedded HTML, quotes, or script payloads.