Live › vulnerability › CVE-2026-119714
The My Calendar WordPress plugin before 3.8.11 passes the mcs search parameter into do_shortcode without encoding brackets. An unauthenticated attacker can make a single GET request that runs registered shortcodes on any page or post, enabling content injection and spoofing.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 16:31 UTC. All times on this page are UTC.
Sites running the My Calendar WordPress plugin between 3.8.8 and 3.8.10 are exposed, because the search parameter is reachable by anyone over HTTP without logging in. Sites that do not use the plugin, or that run 3.8.11 or later, are not affected.
No product ranges from the sources yet.
wp plugin get my-calendar --field=versionmc_search_results in src/my-calendar-search.php of the installed plugin3.8.11 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticated attackers to execute registered shortcodes via the mcs search parameter. The mcs value reaches mc_search_results() in src/my-calendar-search.php without bracket encoding before do_shortcode runs, so a GET request triggers shortcodes on any page or post, enabling content injection and spoofing.
This page as .md · .json · in your agent: get_signal("CVE-2026-119714")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.