Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

joedolson — Vulnerabilities & Security Advisories 8

Browse all 8 CVE security advisories affecting joedolson. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Joedolson develops WordPress accessibility plugins, primarily serving website owners needing compliance solutions. Historically, vulnerabilities have included stored cross-site scripting (XSS), arbitrary file inclusion, and insufficient input validation leading to remote code execution. Notable incidents include CVE-2021-24732, which allowed unauthenticated attackers to execute arbitrary PHP code via crafted requests, and CVE-2021-24733, enabling privilege escalation through improper capability checks. These vulnerabilities often stem from inadequate sanitization of user-supplied data and improper implementation of WordPress security mechanisms. The plugin's core functionality frequently interacts with sensitive WordPress functions, increasing potential attack surface when security controls are misconfigured or bypassed.

Top products by joedolson: My Calendar – Accessible Event Manager My Tickets – Accessible Event Ticketing Able Player, accessible HTML5 media player WP Accessibility my-calendar
CVE IDTitleCVSSSeverityPublished
CVE-2026-6854 My Calendar <= 3.7.8 - Unauthenticated SQL Injection via 'mc_auth' and 'mc_host' Parameters — My Calendar – Accessible Event ManagerCWE-89 7.5 High2026-07-08
CVE-2026-11896 My Calendar <= 3.7.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'vcal' Parameter — My Calendar – Accessible Event ManagerCWE-639 5.3 Medium2026-07-02
CVE-2026-7525 My Calendar <= 3.7.9 - Authenticated (Custom+) Missing Authorization to Unauthorized Event Publication via 'event_approved' Parameter — My Calendar – Accessible Event ManagerCWE-862 4.3 Medium2026-05-14
CVE-2026-40308 My Calendar: Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog — my-calendarCWE-639 7.5AIHighAI2026-04-16
CVE-2026-2355 My Calendar – Accessible Event Manager <= 3.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes — My Calendar – Accessible Event ManagerCWE-79 6.4 Medium2026-03-04
CVE-2026-2362 WP Accessibility <= 2.3.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'alt' Attribute — WP AccessibilityCWE-79 6.4 Medium2026-02-27
CVE-2025-3752 Able Player, accessible HTML5 media player <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via preload Parameter — Able Player, accessible HTML5 media playerCWE-79 6.4 Medium2025-04-25
CVE-2025-3761 My Tickets – Accessible Event Ticketing <= 2.0.16 - Authenticated (Subscriber+) Privilege Escalation — My Tickets – Accessible Event TicketingCWE-269 8.8 High2025-04-24

This page lists every published CVE security advisory associated with joedolson. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.