CVE WATCH / VULNERABILITY DETAIL
CVE-2026-104798
CRITICALCVSS 9.8NVD feed
Published 16 October 2026 · tracked since 17 October 2026
Description
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public `mcs` GET parameter is reflected into post content unsanitized before WordPress core's `do_shortcode` filter runs, allowing an unauthenticated
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-63618 HIGH 7.5
- CVE-2026-111391 HIGH 8.1
- CVE-2026-92766 HIGH 7.5
- CVE-2026-111311 HIGH 8.8
- CVE-2026-75903 HIGH 8.1
- CVE-2026-92553 HIGH 8.8
- CVE-2026-97296 HIGH 8.1
- CVE-2026-92115 HIGH 8.8
- CVE-2026-110015 HIGH 8.8
- CVE-2026-110135 HIGH 7.4