CVE-2026-11896
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14 via the 'vcal' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to enumerate occurrence IDs and access the full iCalendar export of non-public, draft, trashed, and personal calendar events, disclosing sensitive event metadata including titles, descriptions, dates, locations, organizer and host details, permalinks, and related calendar metadata.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2026-40308
My Calendar is a WordPress plugin for managing calendar events. In versions 3.7.6 and below, the mc_ajax_mcjs_action AJAX endpoint, registered for unauthenticated users, passes user-supplied arguments through parse_str() without validation, allowing injection of arbitrary parameters including a site value. On WordPress Multisite installations, this enables an unauthenticated attacker to call switch_to_blog() with an arbitrary site ID and extract calendar events from any sub-site on the network, including private or hidden events. On standard Single Site installations, switch_to_blog() does not exist, causing an uncaught PHP fatal error and crashing the worker thread, creating an unauthenticated denial of service vector. This issue has been fixed in version 3.7.7.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
+ 24 vulnerabilidades conocidas más
| CVE |
Vulnerabilidad |
Tipo |
Gravedad |
Afectadas |
Corregido en |
Publicado |
Estado |
|
—
|
My Calendar – Accessible Event Manager [my-calendar] < 3.4.24 |
— |
Desconocido
|
< 3.4.24
|
3.4.24 |
2024-02-11 |
✓ corregido en la última versión
|
|
CVE-2023-6360
|
My Calendar – Accessible Event Manager [my-calendar] < 3.4.22 |
Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) |
Crítica
9,8
|
< 3.4.22
|
3.4.22 |
2023-11-26 |
✓ corregido en la última versión
|
|
—
|
My Calendar – Accessible Event Manager [my-calendar] < 3.4.4 |
— |
Desconocido
|
< 3.4.4
|
3.4.4 |
2023-01-20 |
✓ corregido en la última versión
|
|
CVE-2023-23813
|
My Calendar – Accessible Event Manager [my-calendar] < 3.4.4 |
Falsificación de petición en sitios cruzados (CSRF) |
Media
5,4
|
< 3.4.4
|
3.4.4 |
2023-01-20 |
✓ corregido en la última versión
|
|
CVE-2022-47427
|
My Calendar – Accessible Event Manager [my-calendar] < 3.3.25 |
Falsificación de petición en sitios cruzados (CSRF) |
Media
5,4
|
< 3.3.25
|
3.3.25 |
2023-01-04 |
✓ corregido en la última versión
|
|
—
|
My Calendar – Accessible Event Manager [my-calendar] < 3.3.25 |
— |
Desconocido
|
< 3.3.25
|
3.3.25 |
2023-01-03 |
✓ corregido en la última versión
|
|
—
|
My Calendar – Accessible Event Manager [my-calendar] < 3.3.17 |
— |
Desconocido
|
< 3.3.17
|
3.3.17 |
2022-07-18 |
✓ corregido en la última versión
|
|
CVE-2021-24927
|
My Calendar – Accessible Event Manager [my-calendar] < 3.2.18 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
5,4
|
< 3.2.18
|
3.2.18 |
2021-11-01 |
✓ corregido en la última versión
|
|
—
|
My Calendar – Accessible Event Manager [my-calendar] < 3.1.10 |
— |
Desconocido
|
< 3.1.10
|
3.1.10 |
2019-05-06 |
✓ corregido en la última versión
|
|
CVE-2019-15713
|
My Calendar – Accessible Event Manager [my-calendar] < 3.1.10 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
6,1
|
< 3.1.10
|
3.1.10 |
2019-04-30 |
✓ corregido en la última versión
|
|
—
|
My Calendar – Accessible Event Manager [my-calendar] < 2.5.17 |
— |
Desconocido
|
< 2.5.17
|
2.5.17 |
2018-04-05 |
✓ corregido en la última versión
|
|
—
|
My Calendar – Accessible Event Manager [my-calendar] < 2.5.17 |
— |
Desconocido
|
< 2.5.17
|
2.5.17 |
2018-04-04 |
✓ corregido en la última versión
|
|
—
|
My Calendar – Accessible Event Manager [my-calendar] < 2.4.11 |
— |
Desconocido
|
< 2.4.11
|
2.4.11 |
2015-11-06 |
✓ corregido en la última versión
|
|
—
|
My Calendar – Accessible Event Manager [my-calendar] < 2.3.30 |
— |
Desconocido
|
< 2.3.30
|
2.3.30 |
2015-05-15 |
✓ corregido en la última versión
|
|
—
|
My Calendar – Accessible Event Manager [my-calendar] < 2.3.30 |
— |
Desconocido
|
< 2.3.30
|
2.3.30 |
2015-05-15 |
✓ corregido en la última versión
|
|
—
|
My Calendar – Accessible Event Manager [my-calendar] < 2.3.30 |
— |
Desconocido
|
< 2.3.30
|
2.3.30 |
2015-05-15 |
✓ corregido en la última versión
|
|
—
|
My Calendar – Accessible Event Manager [my-calendar] < 2.3.29 |
— |
Desconocido
|
< 2.3.29
|
2.3.29 |
2015-04-20 |
✓ corregido en la última versión
|
|
—
|
My Calendar – Accessible Event Manager [my-calendar] < 2.3.10 |
— |
Desconocido
|
< 2.3.10
|
2.3.10 |
2015-04-20 |
✓ corregido en la última versión
|
|
CVE-2012-6527
|
My Calendar – Accessible Event Manager [my-calendar] < 1.10.5 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Desconocido
|
< 1.10.5
|
1.10.5 |
2012-01-18 |
✓ corregido en la última versión
|
|
CVE-2022-36371
|
My Calendar – Accessible Event Manager [my-calendar] < 3.3.17 |
— |
Desconocido
|
< 3.3.17
|
3.3.17 |
0000-00-00 |
✓ corregido en la última versión
|
|
CVE-2026-2355
|
My Calendar – Accessible Event Manager [my-calendar] < 3.7.4 |
— |
Desconocido
|
< 3.7.4
|
3.7.4 |
0000-00-00 |
✓ corregido en la última versión
|
|
—
|
My Calendar – Accessible Event Manager [my-calendar] < 2.5.17 |
— |
Desconocido
|
< 2.5.17
|
2.5.17 |
— |
✓ corregido en la última versión
|
|
—
|
My Calendar – Accessible Event Manager [my-calendar] < 2.3.30 |
— |
Desconocido
|
< 2.3.30
|
2.3.30 |
— |
✓ corregido en la última versión
|
|
—
|
My Calendar – Accessible Event Manager [my-calendar] < 2.3.29 |
— |
Desconocido
|
< 2.3.29
|
2.3.29 |
— |
✓ corregido en la última versión
|
My Calendar – Accessible Event Manager [my-calendar] < 3.4.24
The My Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via events in all versions up to, and including, 3.4.23 due to insufficient input sanitization and output escaping on event dates. This makes it possible for authenticated attackers with, admin-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2023-6360
The My Calendar plugin for WordPress is vulnerable to [blind|generic|time-based] SQL Injection via the 'from' and 'to' parameters of the '/my-calendar/v1/events' rest route in all versions up to, and including, 3.4.21 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
My Calendar – Accessible Event Manager [my-calendar] < 3.4.4
The My Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.3. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to invoke those functions, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2023-23813
Update the WordPress My Calendar plugin to the latest available version (at least 3.4.4).
thiennv discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress My Calendar Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. For example a password change which will then allow the malicious actor to login into the admin account. This vulnerability has been fixed in version 3.4.4.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2022-47427
Update the WordPress My Calendar plugin to the latest available version (at least 3.3.25).
rezaduty discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress My Calendar Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. For example a password change which will then allow the malicious actor to login into the admin account. This vulnerability has been fixed in version 3.3.25.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
My Calendar – Accessible Event Manager [my-calendar] < 3.3.25
The My Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.3.24.1. This is due to missing or incorrect nonce validation on several functions handling the deletion of events and locations. This makes it possible for unauthenticated attackers to remove events or locations, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
My Calendar – Accessible Event Manager [my-calendar] < 3.3.17
The My Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via various parameters including the ‘street’ parameter in versions up to, and including, 3.3.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2021-24927
The My Calendar WordPress plugin before 3.2.18 does not sanitise and escape the callback parameter of the mc_post_lookup AJAX action (available to any authenticated user) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
My Calendar – Accessible Event Manager [my-calendar] < 3.1.10
Unauthenticated Cross-Site Scripting (XSS) vulnerability found by Andreas Hell in WordPress My Calendar plugin (versions <= 3.1.9).
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2019-15713
Triggered via unescaped usage of URL parameters in multiple locations presented in the public view of a site.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
My Calendar – Accessible Event Manager [my-calendar] < 2.5.17
Authenticated Cross-Site Scripting (XSS) vulnerability found in WordPress My Calendar plugin (versions <=2.5.16).
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
My Calendar – Accessible Event Manager [my-calendar] < 2.5.17
The My Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘event_time_label’ parameter in versions up to, and including, 2.6.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
My Calendar – Accessible Event Manager [my-calendar] < 2.4.11
My Calendar plugin is prone to multiple vulnerabilities, such as CSRF and XSS.
Update the plugin.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
My Calendar – Accessible Event Manager [my-calendar] < 2.3.30
This plugin is prone to a reflected XSS and arbitrary file override vulnerabilities. Because of them, attackers can override any existing file that is stored on the server or inject arbitrary JavaScript or HTML.
Update this plugin.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
My Calendar – Accessible Event Manager [my-calendar] < 2.3.30
The My Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘value’ parameter in versions before 2.3.30 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
My Calendar – Accessible Event Manager [my-calendar] < 2.3.30
The My Calendar plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 2.3.29 via the 'edit_my_calendar_styles' function in the 'my-calendar-styles.php' file. This allows unauthenticated attackers to overwrite the contents of all files the vulnerable service has access to, including adding executable PHP to PHP files.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
My Calendar – Accessible Event Manager [my-calendar] < 2.3.29
Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code.
Update the plugin.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
My Calendar – Accessible Event Manager [my-calendar] < 2.3.10
The My Calendar plugin for WordPress is vulnerable to Cross-Site Scripting in versions before 2.3.10 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2012-6527
Cross-site scripting (XSS) vulnerability in the My Calendar plugin before 1.10.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2022-36371
The My Calendar plugin for WordPress is vulnerable to Open Redirection in versions up to, and including, 3.3.16. This makes it possible for unauthenticated attackers to create links that look to be part of an affected site, but will redirect to the attacker's target. This vulnerability can be utilized for malicious redirection and can also be used for phishing.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2026-2355
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `template` attribute of the `[my_calendar_upcoming]` shortcode in all versions up to, and including, 3.7.3. This is due to the use of `stripcslashes()` on user-supplied shortcode attribute values in the `mc_draw_template()` function, which decodes C-style hex escape sequences (e.g., `\x3c` to `<`) at render time, bypassing WordPress's `wp_kses_post()` content sanitization that runs at save time. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
My Calendar – Accessible Event Manager [my-calendar] < 2.5.17
An authenticated user, who can add new events, can inject arbitrary javascript code via event_time_label input. The arbitrary code runs both on the event page and in the admin panel.
In my-calendar-event-manager.php, line 1873, the variable $eventTime is not sanitized.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
My Calendar – Accessible Event Manager [my-calendar] < 2.3.30
The file override vulnerability allows an admin to override any file on the web server, ignoring settings such as DISALLOW_FILE_EDIT.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
My Calendar – Accessible Event Manager [my-calendar] < 2.3.29
The My Calendar WordPress plugin was affected by a Cross-Site Scripting (XSS) security vulnerability.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
Mantén My Calendar actualizado — 3.7.17 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").
Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.