WordPress My Calendar <= 3.1.9 - Cross-Site Scripting

WordPress plugin My Calendar = 3.1.10 or apply the vendor-provided patch to fix the XSS vulnerability. reference: - https://wpscan.com/vulnerability/9267 - https://wordpress.org/plugins/my-calendar/developers - https://nvd.nist.gov/vuln/detail/CVE-2019-15713 -...

WordPress My Calendar <3.4.22 - SQL Injection

WordPress My Calendar plugin versions before 3.4.22 are vulnerable to an unauthenticated SQL injection within the 'from' and 'to' parameters of the '/my-calendar/v1/events' REST route. id: CVE-2023-6360 info: name: WordPress My Calendar 3.4.22 - SQL Injection author: xxcdd severity: critical...

My Calendar WordPress Plugin - Information Disclosure

My Calendar WordPress plugin = 3.7.6 contains an injection vulnerability caused by unvalidated user input passed to parsestr in mcajaxmcjsaction endpoint, letting unauthenticated attackers access or crash sites via switchtoblog, exploit requires WordPress Multisite or Single Site setup. id:...

My Calendar < 3.7.9 - Unauthenticated SQL Injection

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'mcauth' parameter in all versions up to, and including, 3.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-119714

My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticated attackers to execute registered shortcodes via the mcs search parameter. The mcs value reaches mcsearchresults in src/my-calendar-search.php without bracket encoding before...

CVE-2026-119714

The My Calendar WordPress plugin (versions 3.8.8 before 3.8.11 ) is vulnerable to an unauthenticated shortcode injection via the mcs search parameter . The root cause is that the mcs value reaches the mc_search_results() function in src/my-calendar-search.php without undergoing bracket encoding b...

CVE-2026-119714 My Calendar 3.8.8 before 3.8.11 Unauthenticated Shortcode Injection via mcs Parameter

My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticated attackers to execute registered shortcodes via the mcs search parameter. The mcs value reaches mcsearchresults in src/my-calendar-search.php without bracket encoding before...

CVE-2026-119714 My Calendar 3.8.8 before 3.8.11 Unauthenticated Shortcode Injection via mcs Parameter

My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticated attackers to execute registered shortcodes via the mcs search parameter. The mcs value reaches mcsearchresults in src/my-calendar-search.php without bracket encoding before...

CVE-2026-119714 My Calendar 3.8.8 before 3.8.11 Unauthenticated Shortcode Injection via mcs Parameter

My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticated attackers to execute registered shortcodes via the mcs search parameter. The mcs value reaches mcsearchresults in src/my-calendar-search.php without bracket encoding before...

EUVD-2026-114119

My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticated attackers to execute registered shortcodes via the mcs search parameter. The mcs value reaches mcsearchresults in src/my-calendar-search.php without bracket encoding before...

PT-2026-133648

My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticated attackers to execute registered shortcodes via the mcs search parameter. The mcs value reaches mc search results in src/my-calendar-search.php without bracket encoding before ...

CVE-2026-119714: joedolson My Calendar - Accessible Event Manager: My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows…

My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticated attackers to execute registered shortcodes via the mcs search parameter. The mcs value reaches mcsearchresults in src/my-calendar-search.php without bracket encoding before...

CVE-2026-104798

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public mcs GET parameter is reflected into post content unsanitized before WordPress core's doshortcode filter runs, allowing an unauthenticated...

CVE-2026-104798 My Calendar <= 3.8.7 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public mcs GET parameter is reflected into post content unsanitized before WordPress core's doshortcode filter runs, allowing an unauthenticated...

CVE-2026-104798 My Calendar <= 3.8.7 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public mcs GET parameter is reflected into post content unsanitized before WordPress core's doshortcode filter runs, allowing an unauthenticated...

EUVD-2026-102653

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public mcs GET parameter is reflected into post content unsanitized before WordPress core's doshortcode filter runs, allowing an unauthenticated...

CVE-2026-104798

The My Calendar – Accessible Event Manager plugin for WordPress (versions up to and including 3.8.7 ) is vulnerable to unauthenticated Privilege Escalation . The root cause is an unsanitized reflection of the public mcs GET parameter into post content before the do_shortcode filter runs, allowing...

PT-2026-115424

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public mcs GET parameter is reflected into post content unsanitized before WordPress core's do shortcode filter runs, allowing an unauthenticated...

CVE-2026-104798: Improper Privilege Management

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public mcs GET parameter is reflected into post content unsanitized before WordPress core's doshortcode filter runs, allowing an unauthenticated...

WordPress My Calendar plugin <= 3.8.7 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute

Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute vulnerability discovered by daroo in WordPress Plugin My Calendar versions = 3.8.7...