Threats affecting pkg:github/joedolson/my-calendar

A vulnerability in the My Calendar WordPress plugin (versions 3.7.6 and below) allows unauthenticated attackers to exploit an AJAX endpoint that improperly parses user-supplied parameters. On WordPress Multisite installations, this enables unauthorized access to calendar events from any sub-site by switching to arbitrary site IDs. On single-site installations, the flaw causes a PHP fatal error leading to denial of service. The issue is fixed in version 3.7.7.