# My Calendar <= 3.7.17 - Unauthenticated Arbitrary Shortcode Execution via 'mcs' and Query String Parameters

- **ID:** WPSEC-2026-1023
- **Plugin:** My Calendar – Accessible Event Manager (`my-calendar`), https://wordpress.org/plugins/my-calendar/
- **Affected versions:** from 3.7.0 before 3.7.18
- **Fixed in:** 3.7.18 (Update to 3.7.18 or later.)
- **Severity:** High 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
- **Weakness:** CWE-94
- **Usage among sites WPSec scans:** plugin Medium, affected versions Low (as of 2026-10-15)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/my-calendar
- **Fix released:** 2026-10-14
- **Published:** 2026-10-15
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1023/

## Description

The My Calendar plugin for WordPress is vulnerable to arbitrary shortcode execution via query string parameters, including the 'mcs' search term, in versions 3.7.0 to 3.7.17, due to query string values being written into the calendar's search form and navigation hidden fields without neutralizing square brackets before the rendered calendar is processed for shortcodes. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes on any page that displays the calendar.

## References

- https://wpsec.com/vuln/WPSEC-2026-1023/
- https://plugins.svn.wordpress.org/my-calendar/tags/3.7.18/
- https://wordpress.org/plugins/my-calendar/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1023/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.