CVE-2026-119714

{
  "etk_id": "ETK-2026-4063",
  "cve_id": "CVE-2026-119714",
  "display_id": "CVE-2026-119714",
  "ghsa_id": "GHSA-j2m8-rg5v-vvqc",
  "euvd_id": "EUVD-2026-114119",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated shortcode injection in My Calendar",
  "summary": "My Calendar - Accessible Event Manager versions 3.8.8 through 3.8.10 are affected by shortcode injection in search handling. An unauthenticated remote attacker can cause registered WordPress shortcodes to run and inject or spoof content; exploitation requires the vulnerable plugin to be installed and an accessible page or post.",
  "mitigation": "Upgrade My Calendar - Accessible Event Manager to version 3.8.11 or later. Until upgrades are complete, restrict public access to affected WordPress pages where feasible.",
  "vendor": "joedolson",
  "product": "My Calendar - Accessible Event Manager",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 3.8.8, < 3.8.11"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "3.8.11"
      ],
      "package_name": "My Calendar - Accessible Event Manager",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 6.9,
  "cvss_src": "other",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "upstream",
  "exploit": false,
  "pipeline_minutes": 0.010745333333333334,
  "t0_at": "2026-10-30T15:16:12.860000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-10T15:12:02.085123+00:00",
      "days": 10.997097512997685,
      "is_lower_bound": false,
      "measured_at": "2026-10-30T15:16:12.860000+00:00",
      "url": null
    },
    "kev": {
      "at": "2026-11-10T00:00:00+00:00",
      "days": 11,
      "is_lower_bound": false,
      "measured_at": "2026-10-30T15:16:12.860000+00:00",
      "precision": "day",
      "url": "https://vulncheck.com/cve/CVE-2026-119714"
    },
    "trigger_signal": {
      "at": "2026-11-10T00:00:00+00:00",
      "days": 10.363740046296297,
      "is_lower_bound": false,
      "measured_at": "2026-10-30T15:16:12.860000+00:00",
      "url": "https://vulncheck.com/cve/CVE-2026-119714"
    }
  }
}