CVE-2026-77186

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fallback' Shortcode Attribute in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

CVE-2026-77187 My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...

CVE-2026-77186 My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fallback' Shortcode Attribute

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fallback' Shortcode Attribute in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

CVE-2026-77187

The My Calendar – Accessible Event Manager WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.8.3 . The root cause is insufficient input sanitization and output escaping of the before and after shortcode attributes , allowing authenticated at...

CVE-2026-77186 My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fallback' Shortcode Attribute

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fallback' Shortcode Attribute in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

EUVD-2026-74603

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fallback' Shortcode Attribute in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

EUVD-2026-74604

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...

CVE-2026-77186

The My Calendar – Accessible Event Manager WordPress plugin (versions ≤ 3.8.3 ) is vulnerable to Stored Cross-Site Scripting via the fallback shortcode attribute. Authenticated users with contributor-level access or higher can inject arbitrary scripts by submitting hex-encoded payloads (e.g. \x3c...

PT-2026-89159

Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value Summary Calendar events carry a free-form meta object that is stored exactly as submitted, with no validation of the values inside it. The scheduler reads the per-event alert offset out of that object ...

CVE-2024-1207

Booking Calendar = 9.9 - Unauthenticated SQL Injection CVE-2024-1207 https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/booking/booking-calendar-99-unauthenticated-sql-injection POC: root@kitploit: POST /wp-admin/admin-ajax.php HTTP/1.1 Host: vulnerablesite.com User-Agent:...

CVE-2024-8275

CVE-2024-8275 CVE-2024-8275 is a critical SQL injection vulnerability discovered in the WordPress plugin The Events Calendar. This vulnerability affects versions up to and including 6.6.4. The issue arises from insufficient escaping of the 'order' parameter in the tribehasnextevent function...

CVE-2026-49083

CVE-2026-49083 CVE-2026-49083 LatePoint Calendar Booking Plugin Privilege Escalation Exploit 🎲🎲🎲...

WordPress My Calendar – Accessible Event Manager plugin <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin My Calendar versions = 3.8.3...

WordPress My Calendar – Accessible Event Manager plugin <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin My Calendar versions = 3.8.3...

CVE-2026-11349

Modern Events Calendar Lite = 7.33.0 — Unauthenticated SQL Injection via meclistloadmore attsinclude / attsexclude Summary...

WordPress Modern Events Calendar Lite <5.16.5 - Authenticated Arbitrary File Upload

WordPress Modern Events Calendar Lite plugin before 5.16.5 is susceptible to authenticated arbitrary file upload. The plugin does not properly check the imported file, allowing PHP files to be uploaded and/or executed by an administrator or other high-privilege user using the text/csv content-typ...

CVE-2026-84745

The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site, including other...

CVE-2026-84745 The Events Calendar &lt; 6.17.3.1 - Contributor+ Non-Public Event, Venue and Organizer Content Disclosure via REST API

The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site, including other...

CVE-2026-84745 The Events Calendar &lt; 6.17.3.1 - Contributor+ Non-Public Event, Venue and Organizer Content Disclosure via REST API

The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site, including other...

WordPress The Events Calendar plugin < 6.17.3.1 - Contributor+ Non-Public Event, Venue and Organizer Content Disclosure vulnerability

Contributor+ Non-Public Event, Venue and Organizer Content Disclosure vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin The Events Calendar versions 6.17.3.1...