My Calendar – Accessible Event Manager vulnerabilities

2 known vulnerabilities in My Calendar – Accessible Event Manager from Joedolson. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  My Calendar – Accessible Event Manager: Improper Privilege Management

  CVE-2026-104798Oct 16, 2026Joedolson

  The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public `mcs` GET parameter is reflected into post content unsanitized before WordPress core's `do_shortcode`

• 7.5 High severity

  My Calendar – Accessible Event Manager: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-6854Jul 8, 2026JoedolsonEPSS 1.58%

  The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'mc_auth' parameter in all versions up to, and including, 3.7.8 due to insufficient escaping on the user supplied parameter and lack of suff