CVE-2026-77186: My Calendar WordPress Plugin XSS Vulnerability

CVE-2026-77186 Overview

CVE-2026-77186 is a Stored Cross-Site Scripting (XSS) vulnerability in the My Calendar – Accessible Event Manager plugin for WordPress. The flaw affects all versions up to and including 3.8.3. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript through the fallback shortcode attribute. The injected script executes whenever a visitor loads a page containing the malicious shortcode. The vulnerability stems from insufficient input sanitization and output escaping in the plugin's widget rendering code path, mapped to [CWE-79].

Critical Impact
Contributor-level accounts can plant persistent JavaScript payloads that execute in the browser context of any site visitor, enabling session theft, administrative action forgery, and drive-by redirection.

Affected Products

My Calendar – Accessible Event Manager plugin for WordPress
All versions up to and including 3.8.3
WordPress sites allowing contributor-level or higher user registration

Discovery Timeline

2026-09-09 - CVE-2026-77186 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in the NVD database

Technical Details for CVE-2026-77186

Vulnerability Analysis

The vulnerability targets the plugin's shortcode processing pipeline. The fallback attribute (and related substitute argument) accepts user-supplied text that is written into page output without adequate escaping. A contributor authoring a post can embed a My Calendar shortcode that later renders in the front-end DOM, causing the payload to run under the site's origin.

The injected script executes in the browser of any visitor rendering the compromised page. Because the payload persists in post content, exploitation continues until an administrator removes the offending shortcode or upgrades the plugin.

Root Cause

The root cause is a two-stage sanitization bypass. On save, WordPress runs wp_kses_post over post content, which strips real HTML tags but leaves literal backslash escape sequences (for example \\x3cscript\\x3e) intact because they are not valid HTML. At render time, WordPress core's shortcode_parse_atts() invokes stripcslashes() on shortcode attributes, decoding the hex escapes into real angle brackets. The decoded output then reaches the widget render sink in my-calendar-widgets.php unescaped, completing the injection.

Attack Vector

An attacker requires an authenticated account with contributor privileges or higher. The attacker publishes or submits a post containing a My Calendar shortcode whose fallback attribute holds a hex-encoded script payload. When any visitor — including administrators — loads a page that renders the widget, the payload executes with the origin's privileges. No user interaction beyond viewing the page is required.

php

// Vendor patch: src/my-calendar-widgets.php
// Source: https://github.com/joedolson/my-calendar/commit/89bbf7314fac84cdb89e520e8b7b6d69eee8dd3c
} else {
	$header = str_replace( 'mc-event-list ', 'mc-event-list no-events-fallback ', $header );
	$class  = ( str_contains( $args['template'], 'list_preset_' ) ) ? "list-preset $args[template]" : '';
-	$return = $header . $navigation . '<li class="' . $class . '">' . wp_unslash( $args['substitute'] ) . '</li>' . $footer;
+	$return = $header . $navigation . '<li class="' . $class . '">' . wp_kses_post( wp_unslash( $args['substitute'] ) ) . '</li>' . $footer;
}

The fix wraps the substitute argument in wp_kses_post() at render time, stripping the decoded HTML before it reaches the DOM.

Detection Methods for CVE-2026-77186

Indicators of Compromise

My Calendar shortcodes containing fallback or substitute attributes with backslash-hex sequences such as \\x3c, \\x3e, or \\x22 in post content
Unexpected <script> tags rendered inside <li class="...no-events-fallback..."> elements on public pages
Contributor accounts publishing or submitting posts that embed [my_calendar_upcoming] or [my_calendar_today] shortcodes with unusual attribute payloads
Outbound requests from visitor browsers to attacker-controlled domains sourced from calendar widget pages

Detection Strategies

Query the wp_posts table for shortcode attributes containing \x escape sequences or encoded angle brackets
Inspect rendered HTML of pages hosting My Calendar widgets for injected <script>, <iframe>, or event-handler attributes
Review WordPress audit logs for post creation or edits by contributor-role accounts that include My Calendar shortcodes
Deploy Content Security Policy (CSP) violation reporting to surface unexpected inline script execution on calendar pages

Monitoring Recommendations

Alert on new or edited posts submitted by non-editor roles containing My Calendar shortcode syntax
Monitor WordPress plugin inventory for installations of My Calendar at versions 3.8.3 or earlier
Track anomalous outbound network traffic from browsers loading pages that render event widgets
Enable file integrity monitoring on the my-calendar plugin directory to detect tampering

How to Mitigate CVE-2026-77186

Immediate Actions Required

Upgrade the My Calendar – Accessible Event Manager plugin to a version newer than 3.8.3 that includes commit 89bbf7314fac84cdb89e520e8b7b6d69eee8dd3c
Audit existing posts and widget configurations for suspicious fallback or substitute attribute values and remove any hex-encoded payloads
Rotate administrator session cookies and credentials if evidence of exploitation exists
Restrict contributor-level account provisioning and review recently created low-privilege accounts

Patch Information

The vendor fix is available in the upstream repository via commit 89bbf7314fac84cdb89e520e8b7b6d69eee8dd3c. The patch adds wp_kses_post() around the substitute argument in my-calendar-widgets.php, ensuring the decoded shortcode attribute is stripped of executable HTML before rendering. Site administrators should update through the WordPress plugin dashboard or by pulling the latest release. Refer to the Wordfence Vulnerability Report for advisory details.

Workarounds

Temporarily disable the My Calendar plugin until the site can be upgraded to a patched release
Remove contributor and author role permissions for unfiltered_html and reduce publish rights to trusted accounts
Deploy a strict Content Security Policy that blocks inline scripts on pages rendering event widgets
Configure a Web Application Firewall (WAF) rule to block POST requests containing \\x3c, \\x3e, or similar backslash-hex sequences within My Calendar shortcode attributes

bash

# Example WAF rule (ModSecurity) to block hex-encoded shortcode payloads
SecRule ARGS "@rx \\\\x(3c|3e|22|27)" \
    "id:1077186,phase:2,deny,status:403,\
    msg:'CVE-2026-77186: hex-encoded payload in My Calendar shortcode attribute',\
    tag:'wordpress',tag:'xss'"