CVE-2026-40308

My Calendar is a WordPress plugin for managing calendar events. In versions 3.7.6 and below, the mcajaxmcjsaction AJAX endpoint, registered for unauthenticated users, passes user-supplied arguments through parsestr without validation, allowing injection of arbitrary parameters including a site...

CVE-2026-40308

creationtimestamp| type| source ---|---|--- 2026-04-16 17:52:10+00:00| published-proof-of-concept| https://github.com/joedolson/my-calendar/security/advisories/GHSA-2mvx-f5qm-v2ch 2026-04-16 23:18:29+00:00| published-proof-of-concept| Telegram/uUtOgPMgnfpzQaGdgE5uvRP8Wc5QVkmzi4lAg5HL6Ws0-I...