CVE-2026-119714

    Dashboard / Vulnerabilities / CVE-2026-119714

    CVE-2026-119714

    Published: 30 Oct 2026Last Modified: 1 Nov 2026

    Summary: My Calendar 3.8.8 before 3.8.11 Unauthenticated Shortcode Injection via mcs Parameter

    Details: My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticated attackers to execute registered shortcodes via the mcs search parameter. The mcs value reaches mc_search_results() in src/my-calendar-search.php without bracket encoding before do_shortcode runs, so a GET request triggers shortcodes on any page or post, enabling content injection and spoofing.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119714.json, https://github.com/joedolson/my-calendar/releases/tag/v3.8.11, https://nvd.nist.gov/vuln/detail/CVE-2026-119714, https://www.vulncheck.com/advisories/my-calendar-3.8.8-before-3.8.11-unauthenticated-shortcode-injection-via-mcs-parameter, https://github.com/joedolson/my-calendar/commit/de875c25d9651abb041b2dfe32f60a4320c66496, https://github.com/joedolson/my-calendar, https://github.com/joedolson/my-calendar/blob/v3.8.10/src/my-calendar-search.php#L170

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 5761788e39ca65a5c6a9dd075b2bf3db9c519c90
    Fixed -31bdf10142f79a9e4bfeb4eac42f6fdea752992a

    Affected versions

    v3.8.10
    v3.8.9
    v3.8.8

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-119714 | CVE-DB