# My Calendar <= 3.8.10 - Unauthenticated Arbitrary Shortcode Execution via 'mcs' Search Term

- **ID:** WPSEC-2026-1670
- **Plugin:** My Calendar – Accessible Event Manager (`my-calendar`), https://wordpress.org/plugins/my-calendar/
- **Affected versions:** all versions before 3.8.11
- **Fixed in:** 3.8.11 (Update to 3.8.11 or later.)
- **Severity:** High 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
- **Weakness:** CWE-94
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-27)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/my-calendar
- **Fix released:** 2026-10-25
- **Published:** 2026-10-26
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1670/

## Description

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to arbitrary shortcode execution via the 'mcs' search term shown in the search results header in all versions up to, and including, 3.8.10. This is due to the search term being placed in the search results header with only esc_html(), which leaves square brackets intact, and that output being returned from a the_content filter that runs before WordPress processes shortcodes. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

## References

- https://wpsec.com/vuln/WPSEC-2026-1670/
- https://plugins.svn.wordpress.org/my-calendar/tags/3.8.11/
- https://wordpress.org/plugins/my-calendar/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1670/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.