CVE-2026-77187 is a stored cross-site scripting vulnerability (CWE-79) in the My Calendar – Accessible Event Manager plugin for WordPress. The flaw exists due to improper neutralization of input in the 'before' and 'after' shortcode attributes, allowing authenticated users with contributor or higher privileges to inject malicious scripts. These scripts execute in the context of any user who accesses the injected page. The vulnerability affects all versions up to and including 3.8.3. No official patch or remediation guidance has been provided as of the publication date.

An attacker with contributor-level access or above can inject arbitrary web scripts that execute in the browsers of users who view the compromised pages. This can lead to information disclosure or other client-side impacts. The vulnerability does not require user interaction beyond viewing the injected page and does not impact availability. The CVSS score of 6.4 reflects a medium severity with low attack complexity and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider removing or disabling the affected shortcode attributes if possible. Monitor for updates from the vendor for an official fix.