CVE-2026-119714

My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticated attackers to execute registered shortcodes via the mcs search parameter. The mcs value reaches mc search results() in src/my-calendar-search.php without bracket encoding before do shortcode runs, so a GET request triggers shortcodes on any page or post, enabling content injection and spoofing.