Mryudha

**Name of the Vulnerable Software and Affected Versions** My Calendar – Accessible Event Manager plugin for WordPress versions up to and including 3.7.3 **Description** The My Calendar – Accessible Event Manager plugin for WordPress is susceptible to Stored Cross-Site Scripting through the `template` attribute of the `[my calendar upcoming]` shortcode. This is a result of using `stripcslashes()` on user-provided shortcode attribute values within the `mc draw template()` function, which decodes C-style hex escape sequences, bypassing WordPress's content sanitization. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages, which will execute when a user accesses the affected page. **Recommendations** Update My Calendar – Accessible Event Manager plugin to a version later than 3.7.3.