The CP Multi View Events Calendar plugin for WordPress accepts a 'CalendarTitle' parameter that is written to the database without proper sanitization or escaping. Unauthenticated users can provide arbitrary script payloads when the plugin’s frontend editing feature is enabled, resulting in stored cross‑site scripting that executes whenever a visitor loads a page containing the injected title. The injected code runs in the context of each site user, allowing an attacker to perform malicious actions such as defacing the page or executing arbitrary JavaScript.

All WordPress installations that have installed codepeople CP Multi View Events Calendar version 1.4.42 or earlier are affected, but the vulnerability can only be exploited when an administrator has enabled the "Allow edition in frontend?" option. This setting exposes a publicly available add endpoint and a nonce, creating an unauthenticated injection path.

The CVSS base score of 7.2 indicates a high‑severity stored XSS with moderate complexity. The EPSS score of less than 1% suggests a low exploitation likelihood at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. An attacker only needs unauthenticated network access to the add endpoint, making the attack surface significant for sites that have left frontend editing enabled.