Executive Summary

The My Calendar – Accessible Event Manager plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in all versions up to and including 3.7.3. This vulnerability arises from the way the plugin processes the `template` attribute of the `[my_calendar_upcoming]` shortcode. Specifically, the function `mc_draw_template()` uses `stripcslashes()` on user-supplied shortcode attribute values, which decodes C-style hex escape sequences (like `\x3c` to `<`) at render time. This decoding bypasses WordPress's usual content sanitization (`wp_kses_post()`) that runs when content is saved. As a result, authenticated users with Contributor-level access or higher can inject arbitrary web scripts into pages. These scripts execute whenever any user accesses the injected page.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with Contributor-level or higher access to inject malicious scripts into pages via the calendar shortcode's template attribute. These scripts execute in the browsers of users who visit the affected pages, potentially leading to unauthorized actions such as stealing user credentials, session hijacking, defacement, or spreading malware. Since the vulnerability is a Stored Cross-Site Scripting issue, the malicious code persists on the site and affects all visitors to the compromised pages.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

The vulnerability involves Stored Cross-Site Scripting (XSS) via the `template` attribute of the `[my_calendar_upcoming]` shortcode in the My Calendar WordPress plugin versions up to 3.7.3. Detection would involve identifying if your WordPress installation uses this plugin version and if any pages contain injected scripts via this shortcode.

Since the vulnerability requires authenticated users with Contributor-level access or higher to inject scripts, detection can include reviewing recent changes or posts/pages where the `[my_calendar_upcoming]` shortcode is used with a `template` attribute containing suspicious or encoded script tags.

There are no explicit commands provided in the available resources to detect this vulnerability on your network or system.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating the My Calendar WordPress plugin to a version later than 3.7.3 where the vulnerability is fixed.

The patch for CVE-2026-2355 includes backend improvements related to sanitization and template rendering, as well as frontend enhancements to secure AJAX interactions and prevent XSS attacks.

If updating immediately is not possible, restrict Contributor-level and higher user permissions to trusted users only, and audit existing content for injected scripts in pages using the `[my_calendar_upcoming]` shortcode with the `template` attribute.

Useful 0 Not Useful 0