Executive brief
The My Calendar – Accessible Event Manager plugin for WordPress allows authenticated contributors to inject malicious scripts into web pages through a shortcode attribute bypass. When site visitors view affected pages, the injected scripts execute in their browsers, potentially allowing attackers to steal credentials, redirect users, or deface content.
Technical details
The vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the 'fallback' shortcode attribute caused by insufficient input sanitization and output escaping. The attack vector leverages hex-encoded payloads (e.g., \x3cscript\x3e) that bypass WordPress's wp_kses_post filter on save because they appear as literal backslash sequences rather than real HTML tags. During render time, WordPress's shortcode_parse_atts() function calls stripcslashes(), which decodes the hex escapes into real angle brackets before the unescaped data reaches the output sink. This requires authenticated access at contributor level or above, and affects all versions up to and including 3.8.3. A fix has been applied in the upstream repository.
Affected products
- JoeDolson My Calendar – Accessible Event Manager up to and including 3.8.3
Timeline
- 2026-09-09: disclosed
- patched: Fix applied in upstream repository via commit 89bbf73