Security Alert Summary
The My Calendar 6 Accessible Event Manager plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the template attribute of the [my_calendar_upcoming] shortcode in all versions up to and including 3.7.3. An authenticated attacker with Contributor-level access or higher can inject JavaScript that will execute when a user views an affected page.
CVE Details
- CVE ID: CVE-2026-2355
- Affected plugin / component: My Calendar 6 Accessible Event Manager plugin for WordPress
- Affected versions: All versions up to, and including, 3.7.3
- Published: March 4, 2026 at 12:16:03 PM
- Last modified: March 4, 2026 at 12:16:03 PM
- CVSS v3.1: Base Score 6.4, Severity MEDIUM, Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Authentication / privileges / user interaction: Authenticated attackers required; Contributor-level access and above (CVSS
PR:L). User interaction: None (CVSSUI:N). - Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- CWE: CWE-79 (Cross-site Scripting)
Technical Details
The vulnerability is a stored cross-site scripting issue tied to how the plugin processes shortcode attributes at render time. The plugin’s mc_draw_template() function applies stripcslashes() to user-supplied shortcode attribute values for the template attribute of the [my_calendar_upcoming] shortcode. stripcslashes() decodes C-style hex escape sequences (for example, turning x3c into <), which can reintroduce characters that were previously sanitized.
Because WordPress’s wp_kses_post() sanitization runs at save time, the runtime decoding performed by mc_draw_template() effectively bypasses that sanitization, allowing attacker-supplied input to be rendered as active HTML/JavaScript when the shortcode is displayed. The CVE description states that this enables authenticated attackers with Contributor-level access and above to inject arbitrary web scripts into pages that will execute when those pages are viewed.
No fixed version is specified in the provided CVE entry.
How This Could Impact Your Website
Consider a site with a site owner, an internal content editor, and external contributors. If a contributor is able to edit content that uses the vulnerable shortcode, they could include an attribute value that, after server-side decoding, renders executable JavaScript in a page viewed by other users. Practical consequences include targeted phishing or credential theft for users who view the page, unauthorized actions performed in the context of an authenticated user’s browser, or manipulation of displayed content.
Because the documented confidentiality and integrity impacts are low and availability impact is none, this vulnerability is unlikely to cause full site takeover by itself, but it can enable targeted attacks against logged-in users and may expose session information or enable social-engineering campaigns against staff or administrators. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available. (The CVE entry does not specify a fixed version.)
- Temporarily remove or avoid using the
[my_calendar_upcoming]shortcode with untrustedtemplateattributes until the plugin is patched. - Review and reduce unnecessary user roles, especially contributor-level accounts that can submit or edit content.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from the site.
- Monitor site activity and logs for unusual behavior, unexpected content changes, or reports of suspicious pages.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.7.2/my-calendar-shortcodes.php#L112
- https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.7.2/my-calendar-templates.php#L83
- https://plugins.trac.wordpress.org/browser/my-calendar/trunk/my-calendar-shortcodes.php#L112
- https://plugins.trac.wordpress.org/browser/my-calendar/trunk/my-calendar-templates.php#L83
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3464603%40my-calendar%2Ftrunk&old=3454989%40my-calendar%2Ftrunk&sfp_email=&sfph_mail=#file6
- https://www.wordfence.com/threat-intel/vulnerabilities/id/03d5c82e-f82f-4156-bb3e-e6eb365a6c36?source=cve
