CVE-2026-2355
Stored XSS in My Calendar WordPress Plugin Allows Script Injection
Publication date: 2026-03-04
Last updated on: 2026-03-04
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| my_calendar | my_calendar | to 3.7.3 (inc) |
| my_calendar | my_calendar | 3.6.7 |
| my_calendar | my_calendar | 3.7.4 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The My Calendar – Accessible Event Manager plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in all versions up to and including 3.7.3. This vulnerability arises from the way the plugin processes the `template` attribute of the `[my_calendar_upcoming]` shortcode. Specifically, the function `mc_draw_template()` uses `stripcslashes()` on user-supplied shortcode attribute values, which decodes C-style hex escape sequences (like `\x3c` to `<`) at render time. This decoding bypasses WordPress's usual content sanitization (`wp_kses_post()`) that runs when content is saved. As a result, authenticated users with Contributor-level access or higher can inject arbitrary web scripts into pages. These scripts execute whenever any user accesses the injected page.
How can this vulnerability impact me? :
This vulnerability allows attackers with Contributor-level or higher access to inject malicious scripts into pages via the calendar shortcode's template attribute. These scripts execute in the browsers of users who visit the affected pages, potentially leading to unauthorized actions such as stealing user credentials, session hijacking, defacement, or spreading malware. Since the vulnerability is a Stored Cross-Site Scripting issue, the malicious code persists on the site and affects all visitors to the compromised pages.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The vulnerability involves Stored Cross-Site Scripting (XSS) via the `template` attribute of the `[my_calendar_upcoming]` shortcode in the My Calendar WordPress plugin versions up to 3.7.3. Detection would involve identifying if your WordPress installation uses this plugin version and if any pages contain injected scripts via this shortcode.
Since the vulnerability requires authenticated users with Contributor-level access or higher to inject scripts, detection can include reviewing recent changes or posts/pages where the `[my_calendar_upcoming]` shortcode is used with a `template` attribute containing suspicious or encoded script tags.
There are no explicit commands provided in the available resources to detect this vulnerability on your network or system.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the My Calendar WordPress plugin to a version later than 3.7.3 where the vulnerability is fixed.
The patch for CVE-2026-2355 includes backend improvements related to sanitization and template rendering, as well as frontend enhancements to secure AJAX interactions and prevent XSS attacks.
If updating immediately is not possible, restrict Contributor-level and higher user permissions to trusted users only, and audit existing content for injected scripts in pages using the `[my_calendar_upcoming]` shortcode with the `template` attribute.