JO
Vendor
joedolson
15
CVEs
0
On KEV
1
New 30D
Products
MC9.8
My Calendar – Accessible Event Manager
joedolson
7 CVEs0 on KEV1 new
MY9.8
my-calendar
joedolson
4 CVEs0 on KEV0 new
AP6.4
Able Player, accessible HTML5 media player
joedolson
1 CVEs0 on KEV0 new
MC4.8
MY Content Management
Joedolson
1 CVEs0 on KEV0 new
MT8.8
My Tickets – Accessible Event Ticketing
joedolson
1 CVEs0 on KEV0 new
WA6.4
WP Accessibility
joedolson
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-104798 | MC My Calendar – Accessible Event Manager joedolson | 9.8 | Oct 16 | My Calendar <= 3.8.7 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute |
| CVE-2026-77187 | MC My Calendar – Accessible Event Manager joedolson | 6.4 | Sep 9 | My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes |
| CVE-2026-77186 | MC My Calendar – Accessible Event Manager joedolson | 6.4 | Sep 9 | My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fallback' Shortcode Attribute |
| CVE-2026-6854 | MC My Calendar – Accessible Event Manager joedolson | 7.5 | Jul 8 | My Calendar <= 3.7.8 - Unauthenticated SQL Injection via 'mc_auth' and 'mc_host' Parameters |
| CVE-2026-11896 | MC My Calendar – Accessible Event Manager joedolson | 5.3 | Jul 2 | My Calendar <= 3.7.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'vcal' Parameter |
| CVE-2026-7525 | MC My Calendar – Accessible Event Manager joedolson | 4.3 | May 14 | My Calendar <= 3.7.9 - Authenticated (Custom+) Missing Authorization to Unauthorized Event Publication via 'event_approved' Parameter |
| CVE-2026-40308 | MY my-calendar joedolson | 8.8 | Apr 16 | My Calendar: Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog |
| CVE-2026-2355 | MC My Calendar – Accessible Event Manager joedolson | 6.4 | Mar 4 | My Calendar – Accessible Event Manager <= 3.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
| CVE-2026-2362 | WA WP Accessibility joedolson | 6.4 | Feb 27 | WP Accessibility <= 2.3.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'alt' Attribute |
| CVE-2025-3752 | AP Able Player, accessible HTML5 media player joedolson | 6.4 | Apr 25 | Able Player, accessible HTML5 media player <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via preload Parameter |
| CVE-2025-3761 | MT My Tickets – Accessible Event Ticketing joedolson | 8.8 | Apr 24 | My Tickets – Accessible Event Ticketing <= 2.0.16 - Authenticated (Subscriber+) Privilege Escalation |
| CVE-2024-1274 | MC MY Calendar Joedolson | 5.4 | Apr 2 | The My Calendar WordPress plugin before 3.4.24 does not sanitise and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site… |
| CVE-2023-6360 | MC MY Calendar Joedolson | 9.8 | Nov 30 | The 'My Calendar' WordPress Plugin, version < 3.4.22 is affected by an unauthenticated SQL injection vulnerability in the 'from' and 'to' parameters in the… |
| CVE-2023-34377 | MC MY Content Management Joedolson | 4.8 | Aug 5 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Joseph C Dolson My Content Management plugin <= 1.7.6 versions |
| CVE-2012-6527 | MC MY Calendar Joedolson | – | Jan 31 | Cross-site scripting (XSS) vulnerability in the My Calendar plugin before 1.10.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO |