CVE-2026-77187
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Stored Cross-Site Scripting (XSS) vulnerability in the My Calendar – Accessible Event Manager plugin for WordPress, all versions up to and including 3.8.3, via 'before' and 'after' shortcode attributes, due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject scripts that execute when a page is visited.
Risk Assessment
An attacker could steal user data, hijack sessions, or spread malicious content in the context of a trusted page.
Recommendation
Update the plugin to the latest version if available, and restrict contributor permissions.
Other vulnerabilities in My Calendar – Accessible Event Manager
See all- CVE-2026-6854High
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to time-based blind SQL injection via the 'mc_auth' parameter in versions up to and including 3.7.8. This is due to insufficient escaping and lack of proper SQL query preparation.
- CVE-2026-77186Medium
Stored Cross-Site Scripting (XSS) vulnerability in the My Calendar – Accessible Event Manager plugin for WordPress, all versions up to and including 3.8.3, via the 'fallback' shortcode attribute, due to insufficient input sanitization and output escaping. Attackers with contributor-level access and above can inject scripts using hex-encoded payloads that bypass filters.
- CVE-2026-11896Medium
The My Calendar – Accessible Event Manager plugin for WordPress up to version 3.7.14 inclusive contains an Insecure Direct Object Reference (IDOR) vulnerability via the 'vcal' parameter. Missing validation on a user-controlled key allows unauthenticated attackers to enumerate occurrence IDs and access the full iCalendar export of non-public, draft, trashed, and personal calendar events.
Original NVD description (English source)
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS