{
 "id": "WPSEC-2026-1023",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1023/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1023/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1023/index.md",
 "title": "My Calendar <= 3.7.17 - Unauthenticated Arbitrary Shortcode Execution via 'mcs' and Query String Parameters",
 "description": "The My Calendar plugin for WordPress is vulnerable to arbitrary shortcode execution via query string parameters, including the 'mcs' search term, in versions 3.7.0 to 3.7.17, due to query string values being written into the calendar's search form and navigation hidden fields without neutralizing square brackets before the rendered calendar is processed for shortcodes. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes on any page that displays the calendar.",
 "plugin": {
  "slug": "my-calendar",
  "name": "My Calendar",
  "full_name": "My Calendar – Accessible Event Manager",
  "wordpress_org": "https://wordpress.org/plugins/my-calendar/",
  "advisories_url": "https://wpsec.com/vuln/plugin/my-calendar/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/my-calendar"
 },
 "type": "INJECTION",
 "cwe": [
  "CWE-94"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.7.0",
    "from_inclusive": true,
    "to": "3.7.18",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.7.0 before 3.7.18"
  ]
 },
 "introduced_in": "3.7.0",
 "fixed_in": "3.7.18",
 "remediation": "Update to 3.7.18 or later.",
 "fix_released": "2026-10-14T12:50:15+00:00",
 "published": "2026-10-15T12:51:52+00:00",
 "updated": "2026-10-14T19:51:26.545507+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1023/",
  "https://plugins.svn.wordpress.org/my-calendar/tags/3.7.18/",
  "https://wordpress.org/plugins/my-calendar/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/my-calendar",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Low",
  "as_of": "2026-10-15"
 }
}