Plugin icon

My Calendar – Accessible Event Manager

my-calendar

Vulnerabilities:

17

Last Updated:

August 23, 2026

Active Installs:

20000

Published
Title
Fixed in
CVSS
Published
2026-07-07
Title
My Calendar < 3.7.9 - Unauthenticated SQL Injection via 'mc_auth' and 'mc_host' Parameters
Fixed in
Fixed in 3.7.9
CVSS
7.5 (high)
Published
2026-07-01
Title
My Calendar < 3.7.15 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'vcal' Parameter
Fixed in
Fixed in 3.7.15
CVSS
5.3 (medium)
Published
2026-05-13
Title
My Calendar < 3.7.10 - Authenticated (Custom+) Missing Authorization to Unauthorized Event Publication via 'event_approved' Parameter
Fixed in
Fixed in 3.7.10
CVSS
4.3 (medium)
Published
2026-04-16
Title
My Calendar < 3.7.7 - Unauthenticated Denial of Service
Fixed in
Fixed in 3.7.7
CVSS
5.3 (medium)
Published
2026-03-03
Title
My Calendar – Accessible Event Manager < 3.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Fixed in
Fixed in 3.7.4
CVSS
5.5 (medium)
Published
2025-12-15
Title
My Calendar < 3.6.17 - Missing Authorization
Fixed in
Fixed in 3.6.17
CVSS
4.3 (medium)
Published
2024-03-07
Title
My Calendar < 3.4.24 - Authenticated Stored XSS
Fixed in
Fixed in 3.4.24
CVSS
4.3 (medium)
Published
2024-02-11
Title
My Calendar < 3.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Fixed in
Fixed in 3.4.24
CVSS
6.4 (medium)
Published
2023-11-26
Title
My Calendar < 3.4.22 - Unauthenticated SQL Injection
Fixed in
Fixed in 3.4.22
CVSS
9.8 (critical)
Published
2023-01-20
Title
My Calendar < 3.4.4 - Cross-Site Request Forgery
Fixed in
Fixed in 3.4.4
CVSS
5.4 (medium)
Published
2023-01-04
Title
My Calendar < 3.3.25 - Event/Location Deletion via CSRF
Fixed in
Fixed in 3.3.25
CVSS
4.3 (medium)
Published
2021-11-01
Title
My Calendar < 3.2.18 - Subscriber+ Reflected Cross-Site Scripting
Fixed in
Fixed in 3.2.18
CVSS
5.4 (medium)
Published
2019-04-30
Title
My Calendar <= 3.1.9 - Unauthenticated Cross-Site Scripting (XSS)
Fixed in
Fixed in 3.1.10
CVSS
6.1 (medium)
Published
2018-04-04
Title
My Calendar <= 2.5.16 - Authenticated Cross-Site Scripting (XSS)
Fixed in
Fixed in 2.5.17
CVSS
n/a
Published
2015-05-15
Title
My Calendar <= 2.3.29 - Arbitrary File Override & Reflected XSS
Fixed in
Fixed in 2.3.30
CVSS
n/a
Published
2015-04-20
Title
My Calendar <= 2.3.28 - Cross-Site Scripting (XSS)
Fixed in
Fixed in 2.3.29
CVSS
n/a
Published
2014-09-29
Title
My Calendar 1.10.2 - XSS in PATH_INFO Parameter
Fixed in
Fixed in 1.10.5
CVSS
n/a