Threats tagged 'ghsa-j2m8-rg5v-vvqc'

The My Calendar WordPress plugin versions 3.8.8 up to but not including 3.8.11 contain a shortcode injection vulnerability. This flaw allows unauthenticated attackers to execute registered shortcodes via the 'mcs' search parameter. The vulnerability arises because the 'mcs' parameter value is passed to the mc_search_results() function without proper bracket encoding before the do_shortcode function executes, enabling shortcode execution on any page or post. This can lead to content injection and spoofing.