My Calendar – Accessible Event Manager vulnerabilities

Stored Cross-Site Scripting (XSS) vulnerability in the My Calendar – Accessible Event Manager plugin for WordPress, all versions up to and including 3.8.3, via 'before' and 'after' shortcode attributes, due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject scripts that execute when a page is visited.

Stored Cross-Site Scripting (XSS) vulnerability in the My Calendar – Accessible Event Manager plugin for WordPress, all versions up to and including 3.8.3, via the 'fallback' shortcode attribute, due to insufficient input sanitization and output escaping. Attackers with contributor-level access and above can inject scripts using hex-encoded payloads that bypass filters.

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to time-based blind SQL injection via the 'mc_auth' parameter in versions up to and including 3.7.8. This is due to insufficient escaping and lack of proper SQL query preparation.

The My Calendar – Accessible Event Manager plugin for WordPress up to version 3.7.14 inclusive contains an Insecure Direct Object Reference (IDOR) vulnerability via the 'vcal' parameter. Missing validation on a user-controlled key allows unauthenticated attackers to enumerate occurrence IDs and access the full iCalendar export of non-public, draft, trashed, and personal calendar events.