Skip to content
OpenAdvisories

Product · Joe Dolson

my-calendar

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.8
    CVE-2026-40308 Scanner template

    My Calendar: Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog

    My Calendar is a WordPress plugin for managing calendar events. In versions 3.7.6 and below, the mc_ajax_mcjs_action AJAX endpoint, registered for unauthenticated users, passes user-supplied arguments through parse_str() without validation, allowing injection…

    Joe Dolson my-calendar joedolson/my-calendar Web / CMS Packagist