The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to stored cross‑site scripting through the template attribute of the [my_calendar_upcoming] shortcode. The flaw arises because user‑supplied attribute values are processed with stripcslashes, which decodes C‑style escape sequences before WordPress’s content sanitization runs, allowing attackers to store arbitrary JavaScript that executes when a page containing the shortcode is viewed.

All versions of the My Calendar – Accessible Event Manager plugin up to and including 3.7.3 running on WordPress sites are impacted. The vulnerability is present in the mc_draw_template() function handling the template attribute of the [my_calendar_upcoming] shortcode. Contributor‑level or higher authenticated users on affected installations can exploit it.

The CVSS score is 6.4, indicating moderate severity, but the EPSS score is below 1 %, suggesting low likelihood of exploit. The vulnerability is not listed in the CISA KEV catalog. Attackers need only an authenticated Contributor or higher role and use of the shortcode with a crafted template value; the injected script runs for any visitor who loads the affected page. Consequently, the risk is moderate but exploit probability remains low.