WordPress plugin
My Calendar – Accessible Event Manager security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 24 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical3
- High3
- Medium18
- Low0
All My Calendar – Accessible Event Manager vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Critical9.8 | Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute ≤3.8.7Update to 3.4.25 or 3.5.22 or 3.6.18 or 3.7.18 or 3.8.8 | CVE-2026-104798 | |
| High7.5 | Unauthenticated SQL Injection via 'mc_auth' and 'mc_host' Parameters ≤3.7.8Update to 3.7.9 | CVE-2026-6854 | |
| Critical9.8 | Unauthenticated SQL Injection ≤3.4.21Update to 3.4.22 | CVE-2023-6360 | |
| High8.8 | Cross-Site Request Forgery ≤3.4.3Update to 3.4.4 | CVE-2023-23813 | |
| High7.1 | Cross-Site Request Forgery ≤3.3.24.1Update to 3.3.25 | CVE-2022-47427 | |
| Critical9.8 | Path Traversal to Remote Code Execution ≤2.3.29Update to 2.3.30 | — |
- Critical9.8Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute
≤3.8.7Update to 3.4.25 or 3.5.22 or 3.6.18 or 3.7.18 or 3.8.8
- High7.5Unauthenticated SQL Injection via 'mc_auth' and 'mc_host' Parameters
≤3.7.8Update to 3.7.9
- Critical9.8Unauthenticated SQL Injection
≤3.4.21Update to 3.4.22
- High8.8Cross-Site Request Forgery
≤3.4.3Update to 3.4.4
- High7.1Cross-Site Request Forgery
≤3.3.24.1Update to 3.3.25
- Critical9.8Path Traversal to Remote Code Execution
≤2.3.29Update to 2.3.30
My Calendar – Accessible Event Manager: common questions
Does My Calendar – Accessible Event Manager have known vulnerabilities?
Yes. VulnCrest Radar lists 24 known vulnerabilities in My Calendar – Accessible Event Manager: 3 critical, 3 high, 18 medium. None are known to affect version null.
How do I check which version of My Calendar – Accessible Event Manager I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent My Calendar – Accessible Event Manager vulnerability?
CVE-2026-119714, published Oct 30, 2026: My Calendar – Accessible Event Manager 3.8.8 - 3.8.11 - Unauthenticated Arbitrary Shortcode Execution. Severity: Medium (CVSS 6.5).
Is any My Calendar – Accessible Event Manager vulnerability listed in CISA KEV?
No. None of the known My Calendar – Accessible Event Manager vulnerabilities is currently listed in the CISA KEV catalog.