Description
My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticated attackers to execute registered shortcodes via the mcs search parameter. The mcs value reaches mc_search_results() in src/my-calendar-search.php without bracket encoding before do_shortcode runs, so a GET request triggers shortcodes on any page or post, enabling content injection and spoofing.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
joedolson My Calendar - Accessible Event Manager
Default version status: unaffected
3.8.8 to < 3.8.11affected
References
- https://github.com/joedolson/my-calendar/commit/de875c25d9651abb041b2dfe32f60a4320c66496 ↗
- https://github.com/joedolson/my-calendar ↗
- https://github.com/joedolson/my-calendar/releases/tag/v3.8.11 ↗
- https://github.com/joedolson/my-calendar/blob/v3.8.10/src/my-calendar-search.php#L170 ↗
- https://www.vulncheck.com/advisories/my-calendar-3.8.8-before-3.8.11-unauthenticated-shortcode-injection-via-mcs-parameter ↗