My Calendar EUVD-2026-74604

Exploitation requires an authenticated WordPress user account with at least contributor-level role (PR:L). The My Calendar - Accessible Event Manager plugin must be installed and active on the target site. The attacker must be able to create or edit posts/pages that use My Calendar shortcodes. Exploitation is limited to sites where contributor or higher roles are granted to potentially untrusted users - single-administrator WordPress sites are not meaningfully at risk. The injected payload requires a victim to load the page containing the malicious shortcode to trigger execution (stored XSS - passive victim requirement). No special plugin configuration beyond installation is required.

The provided CVSS 6.4 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects network-reachable stored XSS with scope change, but UI:N is likely overstated for stored XSS - a victim must visit the injected page, which per standard CVSS guidance for stored XSS constitutes UI:R, reducing the realistic score to approximately 5.4. The PR:L constraint (contributor-level authentication) meaningfully limits the attack surface compared to unauthenticated XSS, though multi-author WordPress sites commonly grant contributor access broadly. No KEV listing, no POC code identified, and no EPSS data provided - real-world exploitation risk is moderate and opportunistic rather than urgent. The primary concern is multi-author publishing environments where contributor-level access is widely distributed.

An attacker with contributor credentials logs into a WordPress site and creates or edits a post embedding a My Calendar shortcode with a malicious payload in the 'substitute', 'before', or 'after' attribute - for example, injecting a script that steals the visitor's session cookie. When any site visitor (including administrators) loads the affected page, the script executes silently in their browser, potentially granting the attacker session tokens with elevated privileges. No public proof-of-concept code has been identified, but the straightforward nature of the flaw makes independent reproduction trivial.