SZB-db2a995018
EUVD lists unauthenticated shortcode injection in My Calendar WordPress plugin (EUVD-2026-114119)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Joe Dolson
- Product
- My Calendar - Accessible Event Manager
- First seen
Summary
The EUVD listing says My Calendar 3.8.8 before 3.8.11 lets unauthenticated attackers execute registered shortcodes through the mcs search parameter. It gives a CVSS v3.1 score of 6.9/10 and was last updated 2026-10-30.
If you use Joe Dolson
Update the My Calendar plugin to version 3.8.11 or later
Review site logs for requests containing the mcs parameter
Remove the plugin if an update is not available
What the sources say 1
· Mastodon: “My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticated attackers to execute registered shortcodes via the mcs search parameter.” Source