Skip to content
OpenAdvisories

Vendor

Joe Dolson

19 known vulnerabilities.

Products

My Calendar – Accessible Event Manager 8 My Tickets 5 my-calendar 2 My Tickets – Accessible Event Ticketing 1 Able Player 1 WP Accessibility 1 Able Player, accessible HTML5 media player 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.8
    CVE-2026-104798

    My Calendar <= 3.8.7 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute

    The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public `mcs` GET parameter is reflected into post content unsanitized before WordPress core's `do_shortcode`…

    Joe Dolson My Calendar – Accessible Event Manager Web / CMS