Description
My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticated attackers to execute registered shortcodes via the mcs search parameter. The mcs value reaches mc_search_results() in src/my-calendar-search.php without bracket encoding before do_shortcode runs, so a GET request triggers shortcodes on any page or post, enabling content injection and spoofing.
Published: 2026-10-30
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 30 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticated attackers to execute registered shortcodes via the mcs search parameter. The mcs value reaches mc_search_results() in src/my-calendar-search.php without bracket encoding before do_shortcode runs, so a GET request triggers shortcodes on any page or post, enabling content injection and spoofing.
Title My Calendar 3.8.8 before 3.8.11 Unauthenticated Shortcode Injection via mcs Parameter
First Time appeared Joedolson
Joedolson my Calendar
Weaknesses CWE-94
CPEs cpe:2.3:a:joedolson:my_calendar:*:*:*:*:*:wordpress:*:*
Vendors & Products Joedolson
Joedolson my Calendar
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Joedolson My Calendar
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-30T15:42:00.197Z

Reserved: 2026-10-30T14:49:26.430Z

Link: CVE-2026-119714

cve-icon Vulnrichment

Updated: 2026-10-30T15:41:53.803Z

cve-icon NVD

Status : Deferred

Published: 2026-10-30T16:17:54.713

Modified: 2026-10-30T19:23:25.493

Link: CVE-2026-119714

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T16:45:15Z

Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')