joedolson

8 results · Clear filters · Feed

• Medium 6.5
  CVE-2026-119714

  My Calendar 3.8.8 before 3.8.11 Unauthenticated Shortcode Injection via mcs Parameter

  My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticated attackers to execute registered shortcodes via the mcs search parameter. The mcs value reaches mc_search_results() in src/my-calendar-sea…

  joedolson My Calendar – Accessible Event Manager Web / CMS
  Oct 30, 2026
• Medium 6.4
  CVE-2026-77187

  My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes

  The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. …

  joedolson My Calendar – Accessible Event Manager Web / CMS
  Sep 9, 2026
• Medium 6.4
  CVE-2026-77186

  My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fallback' Shortcode Attribute

  The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fallback' Shortcode Attribute in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes …

  joedolson My Calendar – Accessible Event Manager Web / CMS
  Sep 9, 2026
• Medium 5.3
  CVE-2026-11896

  My Calendar <= 3.7.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'vcal' Parameter

  The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14 via the 'vcal' parameter due to missing validation on a user controlled key. This makes it possible …

  joedolson My Calendar – Accessible Event Manager Web / CMS
  Jul 2, 2026
• Medium 4.3
  CVE-2026-7525

  My Calendar <= 3.7.9 - Authenticated (Custom+) Missing Authorization to Unauthorized Event Publication via 'event_approved' Parameter

  The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.7.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it p…

  joedolson My Calendar – Accessible Event Manager Web / CMS
  May 14, 2026
• Medium 6.4
  CVE-2026-2355

  My Calendar – Accessible Event Manager <= 3.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

  The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `template` attribute of the `[my_calendar_upcoming]` shortcode in all versions up to, and including, 3.7.3. This is due to the use of `stripcs…

  joedolson My Calendar – Accessible Event Manager Web / CMS
  Mar 4, 2026
• Medium 6.4
  CVE-2026-2362

  WP Accessibility <= 2.3.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'alt' Attribute

  The WP Accessibility plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'alt' attribute of images processed by the "Long Description UI" feature in all versions up to, and including, 2.3.1. This is due to the plugin's JavaScri…

  joedolson WP Accessibility Web / CMS
  Feb 27, 2026
• Medium 6.4
  CVE-2025-3752

  Able Player, accessible HTML5 media player <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via preload Parameter

  The Able Player, accessible HTML5 media player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘preload’ parameter in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it …

  joedolson Able Player, accessible HTML5 media player Web / CMS
  Apr 25, 2025