CVE-2026-119714: My Calendar 3.8.8 before 3.8.11 Unauthenticated Shortcode Injection via mcs Parameter

Published Oct 30, 2026

Updated

My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticated attackers to execute registered shortcodes via the mcs search parameter. The mcs value reaches mcsearchresults() in src/my-calendar-search.php without bracket encoding before doshortcode runs, so a GET request triggers shortcodes on any page or post, enabling content injection and spoofing.

Event History

Oct 30, 2026

CVE Published

via MITRE·03:16 PM

Data Sourced

via MITRE·03:16 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

WordPress sites using My Calendar versions 3.8.8 through versions before 3.8.11 are affected. The vulnerable search handling can be triggered on any page or post through the mcs parameter.

Does exploitation require an account or user interaction?

No. An unauthenticated attacker can send a GET request containing a crafted mcs search parameter; no privileges or user interaction are required.

What can an attacker do through this issue?

An attacker can cause registered WordPress shortcodes to execute, which can enable injected content and spoofed page content. The supplied impact assessment indicates low confidentiality and integrity impact, with no availability impact.

How can I check whether my site may be affected?

Check the installed My Calendar plugin version. Versions 3.8.8 through before 3.8.11 should be treated as affected, and requests containing unexpected shortcode-like values in the mcs parameter may indicate probing or exploitation attempts.

CVE-2026-119714: My Calendar 3.8.8 before 3.8.11 Unauthenticated Shortcode Injection via mcs Parameter

Event History

Frequently Asked Questions

Which deployments are exposed?

Does exploitation require an account or user interaction?

What can an attacker do through this issue?

How can I check whether my site may be affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

Does exploitation require an account or user interaction?

What can an attacker do through this issue?

How can I check whether my site may be affected?