Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck

CVE-2026-119714My Calendar 3.8.8 before 3.8.11 Unauthenticated Shortcode Injection via mcs Parameter

Medium 6.5

In plain English

A medium-severity code injection in My Calendar - Accessible Event Manager from joedolson. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 76.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticated attackers to execute registered shortcodes via the mcs search parameter. The mcs value reaches mc_search_results() in src/my-calendar-search.php without bracket encoding before do_shortcode runs, so a GET request triggers shortcodes on any page or post, enabling content injection and spoofing.

Affected products (as reported)

Vendor	Product	Versions
joedolson	My Calendar - Accessible Event Manager	3.8.8 – before 3.8.11

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

Patch Commit patch
https://github.com/joedolson/my-calendar product
My Calendar - Accessible Event Manager v3.8.11 Release Notes release-notes
https://github.com/joedolson/my-calendar/blob/v3.8.10/src/my-calendar-search.php#L170 technical-description
VulnCheck Advisory: My Calendar 3.8.8 before 3.8.11 Unauthenticated Shortcode Injection via mcs Parameter third-party-advisory