CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/S:N/AU:N
What the vulnerability does
Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0 - 10.11.2 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar.
Explanation of Vulnerability in Simple Terms
The DP Calendar extension for Joomla contains a cross-site scripting (XSS) vulnerability in versions 7.0.0 through 10.11.2. An authenticated administrator can inject malicious scripts that execute in other users' browsers. The vulnerability requires high-level privileges to exploit but can compromise site security and user data.
What an attacker can do
Inject malicious scripts that run in other users' browsers when they view affected pages.
Potential impact on your site
An admin account compromise could allow script injection affecting all site visitors and administrators.
Conditions required to exploit
Attacker must have administrator-level access to the Joomla site.
Key dates
External resources
Related vulnerabilities
