CVE-2026-78071: Digital-Peak.com Dp Calendar Extension For Joomla

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar.

Affected products

• Digital-Peak.com Dp Calendar Extension For Joomla: version 7.0.0-8.19.5 only; version 9.0.0-10.12.0 only

Published 2026-08-28. Last modified 2026-09-10.