Vulnerabilities / My Calendar / WPSEC-2026-1018
My Calendar <= 3.4.24 - Unauthenticated Arbitrary Shortcode Execution via 'mcs' and Query String Parameters
High 7.3
CWE-94Fixed in 3.4.25
- ID
- WPSEC-2026-1018
- Plugin
- My Calendar – Accessible Event Manager (my-calendar)
- Affected
- all versions before 3.4.25
- Remediation
- Update to 3.4.25 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Weakness
- CWE-94
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-15
- Attack surface
- My Calendar on WPSec AttackSurface
- Fix released
- Published
Description
The My Calendar plugin for WordPress is vulnerable to arbitrary shortcode execution via query string parameters, including the 'mcs' search term, in all versions up to, and including, 3.4.24, due to query string values being written into the calendar's search form and navigation hidden fields without neutralizing square brackets before the rendered calendar is processed for shortcodes. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes on any page that displays the calendar.
References
- https://wpsec.com/vuln/WPSEC-2026-1018/
- https://plugins.svn.wordpress.org/my-calendar/tags/3.4.25/
- https://wordpress.org/plugins/my-calendar/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS