Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-119714— My Calendar 3.8.8 before 3.8.11 Unauthenticated Shortcode Injection via mcs Parameter

Quick assessment

Affected
joedolson My Calendar - Accessible Event Manager
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

My Calendar WordPress 插件 3.8.8 至 3.8.11 版本存在短代码注入漏洞。未认证的攻击者可通过 搜索参数执行已注册的短代码。由于 参数值在调用 函数前未进行括号编码，便直接传入 文件中的 函数，因此攻击者只需发送一个 GET 请求，即可在任何页面或文章上触发短代码执行，从而实现内容注入和伪造。

CVSS 6.5 · Medium

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
joedolson My Calendar - Accessible Event Manager 3.8.8< 3.8.11 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-119714

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
My Calendar 3.8.8 before 3.8.11 Unauthenticated Shortcode Injection via mcs Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticated attackers to execute registered shortcodes via the mcs search parameter. The mcs value reaches mc_search_results() in src/my-calendar-search.php without bracket encoding before do_shortcode runs, so a GET request triggers shortcodes on any page or post, enabling content injection and spoofing.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
joedolson My Calendar - Accessible Event Manager 3.8.8 ~ 3.8.11 -

II. Public POCs for CVE-2026-119714

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-119714

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-119714 (1)

Vendor Advisories for CVE-2026-119714 (1)

Vendor Pages for CVE-2026-119714 (3)

IV. Related Vulnerabilities

Same vendor: joedolson
Same weakness: CWE-94