CVE-2026-119714 My Calendar 3.8.8 before 3.8.11 Unauthenticated Shortcode Injection via mcs Parameter
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-119714?
CVE-2026-119714 is a medium-severity vulnerability in joedolson My Calendar - Accessible Event Manager, published on 30 Oct 2026.
Official description
My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticated attackers to execute registered shortcodes via the mcs search parameter. The mcs value reaches mc_search_results() in src/my-calendar-search.php without bracket encoding before do_shortcode runs, so a GET request triggers shortcodes on any page or post, enabling content injection and spoofing.
Weakness: CWE-94
Which versions are affected by CVE-2026-119714?
How do I fix CVE-2026-119714?
No fix has been published for CVE-2026-119714 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-119714 being exploited?
There is no known exploitation of CVE-2026-119714 in the wild and no public exploit code.
Sources
Also known as GHSA-j2m8-rg5v-vvqc.