My Calendar vulnerabilities

2 known vulnerabilities in My Calendar from Joedolson. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  my-calendar: Authorization Bypass Through User-Controlled Key

  CVE-2026-40308Apr 16, 2026Joedolson

  My Calendar is a WordPress plugin for managing calendar events. In versions 3.7.6 and below, the mc_ajax_mcjs_action AJAX endpoint, registered for unauthenticated users, passes user-supplied arguments through parse_str() without validation, allowing injection

• 9.8 Critical severity

  My Calendar: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2023-6360Nov 30, 2023JoedolsonEPSS 63.1%

  The 'My Calendar' WordPress Plugin, version < 3.4.22 is affected by an unauthenticated SQL injection vulnerability in the 'from' and 'to' parameters in the '/my-calendar/v1/events' rest route.