CVE-2026-119714
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
The My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticated attackers to execute registered shortcodes via the mcs search parameter. The mcs value reaches mc_search_results() without bracket encoding before do_shortcode runs, so a GET request triggers shortcodes on any page or post, enabling content injection and spoofing.
Risk Assessment
An attacker may inject arbitrary content or execute registered shortcode actions on site pages. This could lead to visitor deception or information disclosure.
Recommendation
Update the My Calendar plugin to version 3.8.11 or later. Until updated, consider disabling the plugin or restricting access to the mcs parameter.
Other vulnerabilities in My Calendar
See all- CVE-2026-40308High
My Calendar (WordPress plugin) versions 3.7.6 and below have a vulnerability in the mc_ajax_mcjs_action AJAX endpoint, registered for unauthenticated users. User-supplied arguments are passed through parse_str() without validation, allowing injection of arbitrary parameters including a site value. On WordPress Multisite, this enables an unauthenticated attacker to call switch_to_blog() and extract calendar events from any sub-site, including private ones. On Single Site, it causes an uncaught PHP fatal error and crashes the worker thread (DoS).
- CVE-2026-104798Critical
The My Calendar – Accessible Event Manager plugin for WordPress (versions up to and including 3.8.7) is vulnerable to privilege escalation. The mcs parameter is reflected unsanitized, allowing an unauthenticated attacker to inject a nested [my_calendar above=...] shortcode, which then calls arbitrary PHP functions via call_user_func(), including edit_user(), leading to administrator account takeover.
- CVE-2025-67592Medium
The My Calendar plugin by Joe Dolson for WordPress up to version 3.6.16 contains a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. Attackers can exploit this to perform unauthorized actions.
Original NVD description (English source)
My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticated attackers to execute registered shortcodes via the mcs search parameter. The mcs value reaches mc_search_results() in src/my-calendar-search.php without bracket encoding before do_shortcode runs, so a GET request triggers shortcodes on any page or post, enabling content injection and spoofing.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS