My Calendar EUVD-2026-114119

Requires the My Calendar plugin at versions 3.8.8 through 3.8.10 installed and active, where a request reaches the plugin's search handling so the 'mcs' parameter flows into mc_search_results() and then do_shortcode(). Per the CVSS vector (PR:N/UI:N/AC:L), exploitation is remote and unauthenticated against default behavior with no user interaction. The key limiting factor is scope of impact: the attacker can only execute shortcodes already registered on the target WordPress site, so the realistic effect (content injection and spoofing) depends on which shortcodes are available, and there is no server-side code execution, data exfiltration, or availability impact (VC:L/VI:L/VA:N).

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the attractive part of the profile: a remote, unauthenticated attacker can trigger the flaw with a single low-complexity GET request and no user interaction, which is why it is easy to reach at scale. However, the impact metrics are deliberately modest - VC:L/VI:L/VA:N and no subsequent-system impact (SC/SI/SA:N) - reflecting that the attacker executes only shortcodes already registered on the site, producing content injection and spoofing rather than server code execution or data compromise. Signals are consistent in pointing to medium severity: the assigned score is 6.9 (medium), the vuln.today Decision label is 'this_month' (not act_now/emergency), there is no CISA KEV listing and no EPSS score supplied, and no confirmed working exploit code is referenced. The main caveat is the 'RCE' tag in the input, which overstates the flaw - the description and the Low integrity impact make clear this is shortcode/content injection (CWE-94 in the WordPress sense), not arbitrary remote code execution; treat the RCE label as misleading. Net: patch on a normal cycle (this month), prioritizing internet-facing sites running the affected versions, but this does not warrant out-of-band emergency response on impact grounds alone.

An unauthenticated attacker sends a crafted GET request to a page or post on a site running My Calendar 3.8.8-3.8.10, placing shortcode markup in the 'mcs' search parameter. Because the value reaches mc_search_results() and is passed to do_shortcode without encoding the square brackets, WordPress executes whichever registered shortcodes the attacker supplies, allowing injected or spoofed content to render in the response. No public working exploit code is referenced, though a VulnCheck advisory and the fixing commit disclose the vulnerable code path.