Vulnerabilities / My Calendar / WPSEC-2026-1670
My Calendar <= 3.8.10 - Unauthenticated Arbitrary Shortcode Execution via 'mcs' Search Term
High 7.3
CWE-94Fixed in 3.8.11
- ID
- WPSEC-2026-1670
- Plugin
- My Calendar – Accessible Event Manager (my-calendar)
- Affected
- all versions before 3.8.11
- Remediation
- Update to 3.8.11 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Weakness
- CWE-94
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-27
- Attack surface
- My Calendar on WPSec AttackSurface
- Fix released
- Published
Description
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to arbitrary shortcode execution via the 'mcs' search term shown in the search results header in all versions up to, and including, 3.8.10. This is due to the search term being placed in the search results header with only esc_html(), which leaves square brackets intact, and that output being returned from a the_content filter that runs before WordPress processes shortcodes. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
References
- https://wpsec.com/vuln/WPSEC-2026-1670/
- https://plugins.svn.wordpress.org/my-calendar/tags/3.8.11/
- https://wordpress.org/plugins/my-calendar/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS