{
 "id": "WPSEC-2026-1670",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1670/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1670/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1670/index.md",
 "title": "My Calendar <= 3.8.10 - Unauthenticated Arbitrary Shortcode Execution via 'mcs' Search Term",
 "description": "The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to arbitrary shortcode execution via the 'mcs' search term shown in the search results header in all versions up to, and including, 3.8.10. This is due to the search term being placed in the search results header with only esc_html(), which leaves square brackets intact, and that output being returned from a the_content filter that runs before WordPress processes shortcodes. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.",
 "plugin": {
  "slug": "my-calendar",
  "name": "My Calendar",
  "full_name": "My Calendar – Accessible Event Manager",
  "wordpress_org": "https://wordpress.org/plugins/my-calendar/",
  "advisories_url": "https://wpsec.com/vuln/plugin/my-calendar/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/my-calendar"
 },
 "type": "CONTENT INJECTION",
 "cwe": [
  "CWE-94"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.8.11",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.8.11"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.8.11",
 "remediation": "Update to 3.8.11 or later.",
 "fix_released": "2026-10-25T15:38:56+00:00",
 "published": "2026-10-26T16:06:40+00:00",
 "updated": "2026-10-26T09:30:41.799316+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1670/",
  "https://plugins.svn.wordpress.org/my-calendar/tags/3.8.11/",
  "https://wordpress.org/plugins/my-calendar/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/my-calendar",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-27"
 }
}