Joedolson vulnerabilities
We track 5 vulnerabilities in Joedolson products across 3 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on October 16, 2026.
Latest Joedolson vulnerabilities
- 9.8 Critical severity
My Calendar – Accessible Event Manager: Improper Privilege Management
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public `mcs` GET parameter is reflected into post content unsanitized before WordPress core's `do_shortcode`
- 7.5 High severity
My Calendar – Accessible Event Manager: Improper Neutralization of Special Elements used in an SQL Command
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'mc_auth' parameter in all versions up to, and including, 3.7.8 due to insufficient escaping on the user supplied parameter and lack of suff
- 8.8 High severity
my-calendar: Authorization Bypass Through User-Controlled Key
My Calendar is a WordPress plugin for managing calendar events. In versions 3.7.6 and below, the mc_ajax_mcjs_action AJAX endpoint, registered for unauthenticated users, passes user-supplied arguments through parse_str() without validation, allowing injection
- 8.8 High severity
My Tickets – Accessible Event Ticketing: Improper Privilege Management
The My Tickets – Accessible Event Ticketing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.16. This is due to the mt_save_profile() function not appropriately restricting access to unauthorized users to upd
- 9.8 Critical severity
My Calendar: Improper Neutralization of Special Elements used in an SQL Command
The 'My Calendar' WordPress Plugin, version < 3.4.22 is affected by an unauthenticated SQL injection vulnerability in the 'from' and 'to' parameters in the '/my-calendar/v1/events' rest route.