Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-119714

My Calendar 3.8.8 before 3.8.11 Unauthenticated Shortcode Injection via mcs Parameter

My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticated attackers to execute registered shortcodes via the mcs search parameter. The mcs value reaches mc_search_results() in src/my-calendar-search.php without bracket encoding before do_shortcode runs, so a GET request triggers shortcodes on any page or post, enabling content injection and spoofing.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Joedolson Wordpress-extensions
Products
My-calendar My Calendar My Calendar
CVE-2025-67592

WordPress My Calendar plugin <= 3.6.16 - Broken Access Control vulnerability

Missing Authorization vulnerability in Joe Dolson My Calendar my-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Calendar: from n/a through <= 3.6.16.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Joedolson Wordpress
Products
My-calendar Wordpress
CVE-2026-40308

My Calendar: Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog

My Calendar is a WordPress plugin for managing calendar events. In versions 3.7.6 and below, the mc_ajax_mcjs_action AJAX endpoint, registered for unauthenticated users, passes user-supplied arguments through parse_str() without validation, allowing injection of arbitrary parameters including a site value. On WordPress Multisite installations, this enables an unauthenticated attacker to call switch_to_blog() with an arbitrary site ID and extract calendar events from any sub-site on the network, including private or hidden events. On standard Single Site installations, switch_to_blog() does not exist, causing an uncaught PHP fatal error and crashing the worker thread, creating an unauthenticated denial of service vector. This issue has been fixed in version 3.7.7.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Joedolson Wordpress
Products
My-calendar Wordpress