{"id":"CVE-2026-119714","kind":"vulnerability","aliases":["CVE-2026-119714"],"related":[],"title":"My Calendar WordPress plugin: unauthenticated shortcode injection via search parameter","description":"My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticated attackers to execute registered shortcodes via the mcs search parameter. The mcs value reaches mc_search_results() in src/my-calendar-search.php without bracket encoding before do_shortcode runs, so a GET request triggers shortcodes on any page or post, enabling content injection and spoofing.","summary":"The My Calendar WordPress plugin before 3.8.11 passes the mcs search parameter into do_shortcode without encoding brackets. An unauthenticated attacker can make a single GET request that runs registered shortcodes on any page or post, enabling content injection and spoofing.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["my-calendar","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed","version-3.8.11-or-later"],"how_to_check":"- Check the installed My Calendar plugin version in the WordPress admin Plugins screen or with `wp plugin get my-calendar --field=version`\n- Look for `mc_search_results` in `src/my-calendar-search.php` of the installed plugin","fix":"- My Calendar: move to `3.8.11` or later","status":"open","published_at":"2026-10-30T16:17:54+00:00","first_seen_at":"2026-10-30T16:31:26+00:00","triaged_at":"2026-10-30T16:32:07+00:00","updated_at":"2026-10-30T16:32:07+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-30T16:32:07Z","model":"claude-haiku-5-5","output":{"fix":"- My Calendar: move to `3.8.11` or later","reach":"internet","title":"My Calendar WordPress plugin: unauthenticated shortcode injection via search parameter","impact":"medium","summary":"The My Calendar WordPress plugin before 3.8.11 passes the mcs search parameter into do_shortcode without encoding brackets. An unauthenticated attacker can make a single GET request that runs registered shortcodes on any page or post, enabling content injection and spoofing.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","my-calendar","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated visitors inject content and spoof pages on the site","analyst_note":"","how_to_check":"- Check the installed My Calendar plugin version in the WordPress admin Plugins screen or with `wp plugin get my-calendar --field=version`\n- Look for `mc_search_results` in `src/my-calendar-search.php` of the installed plugin","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-3.8.11-or-later"],"who_is_affected":"Sites running the My Calendar WordPress plugin between 3.8.8 and 3.8.10 are exposed, because the search parameter is reachable by anyone over HTTP without logging in. Sites that do not use the plugin, or that run 3.8.11 or later, are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000694,"input_tokens":4181,"output_tokens":552,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119714':13A,16A '-2026':12A,15A '3.8.11':31B,72C '3.8.8':70C 'allow':79C 'attack':45B,81C 'bracket':42B,101C 'calendar':2A,19B,27B,67C 'contain':73C 'content':62B,119C 'cve':11A,14A 'enabl':61B,118C 'encod':41B,102C 'execut':83C 'get':50B,109C 'host':23B 'inject':7A,63B,76C,120C 'make':47B 'mc':95C 'mcs':34B,88C,92C 'my-calendar':17B 'packag':20B 'page':58B,115C 'paramet':10A,36B,90C 'pass':32B 'plugin':4A,29B,69C 'post':60B,117C 'reach':94C 'regist':54B,84C 'request':51B,110C 'result':97C 'run':53B,106C 'search':9A,35B,89C,96C 'self':22B 'self-host':21B 'shortcod':6A,39B,55B,75C,85C,105C,112C 'singl':49B 'spoof':65B,122C 'src/my-calendar-search.php':99C 'trigger':111C 'unauthent':5A,44B,80C 'valu':93C 'via':8A,86C 'vulner':77C 'without':40B,100C 'wordpress':3A,24B,28B,68C","nicknames":[],"mitigations":[],"who_affected":"Sites running the My Calendar WordPress plugin between 3.8.8 and 3.8.10 are exposed, because the search parameter is reachable by anyone over HTTP without logging in. Sites that do not use the plugin, or that run 3.8.11 or later, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T16:17:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119714","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119714","severity":null,"published_at":"2026-10-30T16:17:54+00:00","modified_at":"2026-10-30T16:17:54+00:00","first_seen_at":"2026-10-30T16:31:26+00:00","fetched_at":"2026-10-30T16:31:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}