CVE-2026-77187

Deferred Deferred - Pending Action

Stored XSS in My Calendar WordPress Plugin

Publication date: 2026-09-09

Last updated on: 2026-09-11

Assigner: Wordfence

Description

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-11

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-77187

EUVD

EUVD-2026-74604

Affected Vendors & Products

Vendor	Product	Version / Range
my_calendar	accessible_event_manager	to 3.8.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) issue in the My Calendar – Accessible Event Manager WordPress plugin. It affects versions up to and including 3.8.3 due to insufficient input sanitization and output escaping in the 'before' and 'after' Shortcode Attributes. Authenticated attackers with contributor-level access or higher can inject malicious scripts into pages.

Detection Guidance

Check for the presence of the My Calendar plugin in WordPress installations. Inspect plugin versions to identify installations running versions up to and including 3.8.3. Look for unauthorized script injections in pages using the 'before' or 'after' shortcode attributes.

Impact Analysis

An attacker could inject malicious scripts that execute when users access infected pages. This could lead to unauthorized actions on behalf of users, data theft, or defacement of your WordPress site. Users with contributor-level access or above could exploit this to compromise site visitors.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. A successful exploit may result in data breaches, triggering compliance violations and potential legal penalties.

Mitigation Strategies

Update the My Calendar plugin to the latest version beyond 3.8.3. Remove or restrict contributor-level access to untrusted users. Review pages for injected scripts and sanitize any suspicious content.

Hi! I’m here to help you understand CVE-2026-77187. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70