The author is releasing an update to My Calendar as part of a coordinated security release affecting dozens of major plug-ins in the WordPress.org repository. If you’re currently running any version in the 2.3.x branch of My Calendar, your site is vulnerable. If you’re on an older version of My Calendar, you are not vulnerable to this security issue, but you may be vulnerable to a security issue I fixed in version 2.3.10.
All users should upgrade as soon as possible.
More details here.