My Calendar <= 2.5.16 - Authenticated Stored Cross-Site Scripting

Wordfence Intelligence   >   Vulnerability Database   >   My Calendar <= 2.5.16 - Authenticated Stored Cross-Site Scripting
6.4
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS 6.4 (Medium)
Publicly Published April 4, 2018
Last Updated January 30, 2023
Researcher Luigi Gubello

Description

The My Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘event_time_label’ parameter in versions up to, and including, 2.6.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Learn more about Cross-Site Scripting vulnerabilities and how to prevent them.

References

Share

Vulnerability Details for My Calendar – Accessible Event Manager

My Calendar – Accessible Event Manager

Software Type Plugin
Software Slug my-calendar (view on wordpress.org)
Patched? Yes
Remediation Update to version 2.5.17, or a newer patched version
Affected Version
  • < 2.5.17
Patched Version
  • 2.5.17

Recent vulnerabilities in My Calendar – Accessible Event Manager

My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fallback' Shortcode Attribute
6.4
CVE-2026-77186
Sep 8, 2026
Researcher: Wordfence PRISM
My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes
6.4
CVE-2026-77187
Sep 8, 2026
Researcher: Wordfence PRISM
My Calendar <= 3.7.8 - Unauthenticated SQL Injection via 'mc_auth' and 'mc_host' Parameters
7.5
CVE-2026-6854
Jul 7, 2026
Researcher: Leonid Semenenko (lsemenenko)
My Calendar <= 3.7.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'vcal' Parameter
5.3
CVE-2026-11896
Jul 1, 2026
Researchers: Athiwat Tiprasaharn (Jitlada), Tharadol Suksamran (d3kc4rt_1)
My Calendar <= 3.7.9 - Authenticated (Custom+) Missing Authorization to Unauthorized Event Publication via 'event_approved' Parameter
4.3
CVE-2026-7525
May 13, 2026
Researcher: type5afe
My Calendar < 3.7.7 - Unauthenticated Denial of Service
5.3
CVE-2026-40308
Apr 16, 2026
Researcher: minhi1
My Calendar – Accessible Event Manager <= 3.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
6.4
CVE-2026-2355
Mar 3, 2026
Researcher: Muhammad Yudha - DJ
My Calendar <= 3.6.16 - Missing Authorization
4.3
CVE-2025-67592
Dec 15, 2025
Researcher: Doan Dinh Van (d52v)
My Calendar <= 3.4.23 - Authenticated (Admin+) Stored Cross-Site Scripting via Events
4.4
CVE-2024-1274
Feb 11, 2024
Researcher: cyc707
My Calendar <= 3.4.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2024-25916
Feb 11, 2024
Researcher: Steven Julian
# Title CVE ID CVSS Researchers Date
1 My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fallback' Shortcode Attribute CVE-2026-77186 6.4 Wordfence PRISM September 8, 2026
2 My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes CVE-2026-77187 6.4 Wordfence PRISM September 8, 2026
3 My Calendar <= 3.7.8 - Unauthenticated SQL Injection via 'mc_auth' and 'mc_host' Parameters CVE-2026-6854 7.5 Leonid Semenenko (lsemenenko) July 7, 2026
4 My Calendar <= 3.7.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'vcal' Parameter CVE-2026-11896 5.3 Athiwat Tiprasaharn (Jitlada), Tharadol Suksamran (d3kc4rt_1) July 1, 2026
5 My Calendar <= 3.7.9 - Authenticated (Custom+) Missing Authorization to Unauthorized Event Publication via 'event_approved' Parameter CVE-2026-7525 4.3 type5afe May 13, 2026
6 My Calendar < 3.7.7 - Unauthenticated Denial of Service CVE-2026-40308 5.3 minhi1 April 16, 2026
7 My Calendar – Accessible Event Manager <= 3.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes CVE-2026-2355 6.4 Muhammad Yudha - DJ March 3, 2026
8 My Calendar <= 3.6.16 - Missing Authorization CVE-2025-67592 4.3 Doan Dinh Van (d52v) December 15, 2025
9 My Calendar <= 3.4.23 - Authenticated (Admin+) Stored Cross-Site Scripting via Events CVE-2024-1274 4.4 cyc707 February 11, 2024
10 My Calendar <= 3.4.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2024-25916 6.4 Steven Julian February 11, 2024
View more vulnerabilities in this software package View more vulnerabilities

This record contains material that is subject to copyright.

Copyright 2012-2026 Defiant Inc.

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more.

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation