CVE-2026-77187: My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with Contributor-level permissions or higher. They must be able to add shortcode content to a page or other location that will be viewed by users.
What happens after malicious content is inserted?
Scripts injected through the before or after shortcode attributes are stored and execute in visitors' browsers whenever they access the affected page. The vulnerability can affect confidentiality and integrity in the context of the viewing user's session.
Which installations are affected?
All versions of the My Calendar – Accessible Event Manager plugin through version 3.8.3 are affected. The provided information does not identify a fixed version or a configuration-based workaround.