Skip to content

Known CVE

My Calendar WordPress Plugin - Information Disclosure

My Calendar WordPress plugin <= 3.7.6 contains an injection vulnerability caused by unvalidated user input passed to parse_str() in mc_ajax_mcjs_action endpoint, letting unauthenticated attackers access or crash sites via switch_to_blog(), exploit requires WordPress Multisite or Single Site setup.

CVE-2026-40308

High2026CWE-639

cve2026 · wordpress · wp-plugin · my-calendar · idor · information-disclosure

Verified scans run this check after you prove you own the site.

All known CVEsView the checks catalogNational Vulnerability Database

Scan a website