Shortcode Injection Vulnerability in My Calendar Plugin by WordPress
CVE-2026-119714

6.9MEDIUM

Key Information:

Vendor

WordPress
Status
My Calendar - Accessible Event Manager
Vendor
CVE Published:
30 October 2026

What is CVE-2026-119714?

The My Calendar plugin for WordPress prior to version 3.8.11 is susceptible to a shortcode injection flaw. This vulnerability allows unauthenticated attackers to exploit the mcs search parameter, executing registered shortcodes without proper validation. When a GET request is made with the mcs value, it is processed in the mc_search_results() function without the necessary bracket encoding, enabling potential content injection and spoofing across any page or post. Users are encouraged to update to version 3.8.11 or later to mitigate this risk.

Affected Version(s)

My Calendar - Accessible Event Manager 3.8.8 < 3.8.11

References

https://github.com/joedolson/my-calendar/commit/de875c25d...
patch
https://github.com/joedolson/my-calendar
product
https://github.com/joedolson/my-calendar/releases/tag/v3....
release-notes

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Andres Poulin Mateos (Drakon Tech Solutions SLU)
joedolson
.