CVE-2026-119714 My Calendar 3.8.8 before 3.8.11 Unauthenticated Shortcode Injection via mcs Parameter

My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticated attackers to execute registered shortcodes via the mcs search parameter. The mcs value reaches mcsearchresults in src/my-calendar-search.php without bracket encoding before...

CVE-2026-119714 My Calendar 3.8.8 before 3.8.11 Unauthenticated Shortcode Injection via mcs Parameter

My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticated attackers to execute registered shortcodes via the mcs search parameter. The mcs value reaches mcsearchresults in src/my-calendar-search.php without bracket encoding before...

CVE-2026-119714 My Calendar 3.8.8 before 3.8.11 Unauthenticated Shortcode Injection via mcs Parameter

My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticated attackers to execute registered shortcodes via the mcs search parameter. The mcs value reaches mcsearchresults in src/my-calendar-search.php without bracket encoding before...

CVE-2026-119714

The My Calendar WordPress plugin (versions 3.8.8 before 3.8.11 ) is vulnerable to an unauthenticated shortcode injection via the mcs search parameter . The root cause is that the mcs value reaches the mc_search_results() function in src/my-calendar-search.php without undergoing bracket encoding b...