Software intelligence
Important: My Calendar appearing in this catalog does not mean your website is affected. Exposure depends on your installed version. How SiteRespond intelligence works
Tracked advisories
20
Latest advisory
7 July 2026
CISA KEV matches
0
In this WordPress feed
WordPress slug
my-calendar
Plugin
This catalog lists 20 known advisories affecting My Calendar. The most recent was published on 7 July 2026. If you use this software, compare your installed version against the affected ranges on each advisory and update to a fixed release outside those ranges. SiteRespond Defence checks your actual installed version when the plugin is connected — listing here does not by itself mean your site is vulnerable.
My Calendar <= 3.7.8 - Unauthenticated SQL Injection via 'mc_auth' and 'mc_host' Parameters
May allow attackers to read or modify database contents beyond intended access.
Published 7 July 2026
My Calendar <= 3.7.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'vcal' Parameter
This advisory describes a other issue in the affected software. Review the source advisory and your installed version to assess exposure.
Published 1 July 2026
My Calendar <= 3.7.9 - Authenticated (Custom+) Missing Authorization to Unauthorized Event Publication via 'event_approved' Parameter
This advisory describes a other issue in the affected software. Review the source advisory and your installed version to assess exposure.
Published 13 May 2026
Known My Calendar advisories published by month.
CVE-2026-6854 · Published 7 July 2026
Affected versions: ≤ 3.7.8
CVE-2026-11896 · Published 1 July 2026
Affected versions: ≤ 3.7.14
CVE-2026-7525 · Published 13 May 2026
Affected versions: ≤ 3.7.9
CVE-2026-40308 · Published 16 April 2026
Affected versions: < 3.7.7
CVE-2026-2355 · Published 3 March 2026
Affected versions: ≤ 3.7.3
CVE-2025-67592 · Published 15 December 2025
Affected versions: ≤ 3.6.16
CVE-2024-25916 · Published 11 February 2024
Affected versions: ≤ 3.4.23
CVE-2024-1274 · Published 11 February 2024
Affected versions: ≤ 3.4.23
CVE-2023-6360 · Published 26 November 2023
Affected versions: ≤ 3.4.21
CVE-2023-23813 · Published 20 January 2023
Affected versions: ≤ 3.4.3
CVE-2022-47427 · Published 3 January 2023
Affected versions: ≤ 3.3.24.1
CVE-2022-36371 · Published 2 August 2022
Affected versions: ≤ 3.3.16
No CVE assigned · Published 18 July 2022
Affected versions: ≤ 3.3.16
CVE-2021-24927 · Published 1 November 2021
Affected versions: ≤ 3.2.17
CVE-2019-15713 · Published 30 April 2019
Affected versions: ≤ 3.1.9
SiteRespond Defence matches your installed My Calendar version against this catalog when the Defence plugin is connected to your WordPress site.