WordPress plugin
My Calendar – Accessible Event Manager security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 24 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical3
- High3
- Medium18
- Low0
All My Calendar – Accessible Event Manager vulnerabilities
- Medium6.53.8.11 - Unauthenticated Arbitrary Shortcode Execution
3.8.8 – <3.8.11Update to 3.8.11
- Critical9.8Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute
≤3.8.7Update to 3.4.25 or 3.5.22 or 3.6.18 or 3.7.18 or 3.8.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'fallback' Shortcode Attribute
≤3.8.3Update to 3.8.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes
≤3.8.3Update to 3.8.4
- High7.5Unauthenticated SQL Injection via 'mc_auth' and 'mc_host' Parameters
≤3.7.8Update to 3.7.9
- Medium5.3Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'vcal' Parameter
≤3.7.14Update to 3.7.15
- Medium4.3Authenticated (Custom+) Missing Authorization to Unauthorized Event Publication via 'event_approved' Parameter
≤3.7.9Update to 3.7.10
- Medium5.3Unauthenticated Denial of Service
<3.7.7Update to 3.7.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
≤3.7.3Update to 3.7.4
- Medium4.3Missing Authorization
≤3.6.16Update to 3.6.17
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting via Events
≤3.4.23Update to 3.4.24
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤3.4.23Update to 3.4.24
- Critical9.8Unauthenticated SQL Injection
≤3.4.21Update to 3.4.22
- High8.8Cross-Site Request Forgery
≤3.4.3Update to 3.4.4
- High7.1Cross-Site Request Forgery
≤3.3.24.1Update to 3.3.25
- Medium4.7Open Redirect
≤3.3.16Update to 3.3.17
- Medium5.5Administrator+ Stored Cross-Site Scripting
≤3.3.16Update to 3.3.17
- Medium5.4Subscriber+ Reflected Cross-Site Scripting
≤3.2.17Update to 3.2.18
- Medium6.1Unauthenticated Cross-Site Scripting
≤3.1.9Update to 3.1.10
- Medium6.4Authenticated Stored Cross-Site Scripting
<2.5.17Update to 2.5.17
- Critical9.8Path Traversal to Remote Code Execution
≤2.3.29Update to 2.3.30
- Medium6.1Reflected Cross-Site Scripting
<2.3.30Update to 2.3.30
- Medium6.1Reflected Cross-Site Scripting
<2.3.10Update to 2.3.10
- Medium6.1Cross-Site Scripting
<1.10.5Update to 1.10.5
My Calendar – Accessible Event Manager: common questions
Does My Calendar – Accessible Event Manager have known vulnerabilities?
Yes. VulnCrest Radar lists 24 known vulnerabilities in My Calendar – Accessible Event Manager: 3 critical, 3 high, 18 medium. None are known to affect version null.
How do I check which version of My Calendar – Accessible Event Manager I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent My Calendar – Accessible Event Manager vulnerability?
CVE-2026-119714, published Oct 30, 2026: My Calendar – Accessible Event Manager 3.8.8 - 3.8.11 - Unauthenticated Arbitrary Shortcode Execution. Severity: Medium (CVSS 6.5).
Is any My Calendar – Accessible Event Manager vulnerability listed in CISA KEV?
No. None of the known My Calendar – Accessible Event Manager vulnerabilities is currently listed in the CISA KEV catalog.