my_calendar 漏洞

高危CVE-2026-403082026/06/25

My Calendar WordPress Plugin - Information Disclosure

My Calendar WordPress plugin <= 3.7.6 contains an injection vulnerability caused by unvalidated user input passed to parse_str() in mc_ajax_mcjs_action endpoint, letting unauthenticated attackers access or crash sites via switch_to_blog(), exploit requires WordPress Multisite or Single Site setup.

my_calendarPoC 已收录

CVSS—

严重CVE-2023-63602023/12/01

WordPress My Calendar <3.4.22 - SQL Injection

WordPress My Calendar plugin versions before 3.4.22 are vulnerable to an unauthenticated SQL injection within the 'from' and 'to' parameters of the '/my-calendar/v1/events' REST route.

my_calendarPoC 已收录RCE

CVSS9.8EPSS 84.6%

中危CVE-2019-157132019/08/28

WordPress My Calendar <= 3.1.9 - Cross-Site Scripting

WordPress plugin My Calendar <= 3.1.9 is susceptible to reflected cross-site scripting which can be triggered via unescaped usage of URL parameters in multiple locations throughout the site.

my_calendarPoC 已收录

CVSS6.1EPSS 4.7%

my_calendar

关联漏洞

My Calendar WordPress Plugin - Information Disclosure

WordPress My Calendar <3.4.22 - SQL Injection

WordPress My Calendar <= 3.1.9 - Cross-Site Scripting