CVE-2021-24925: vulnerability in Modern Events Calendar Lite
Modern Events Calendar Lite < 6.1.5 - Reflected Cross-Site Scripting
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 0.8%
The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the current_month_divider parameter of its mec_list_load_more AJAX call (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue
Affected products
Unknown · Modern Events Calendar LiteRelated CVEs — Modern Events Calendar Lite
In the same product, most dangerous first.
CVE-2021-24145—Modern Events Calendar Lite < 5.16.5 - Authenticated Arbitrary File Upload leading to RCEEPSS 88.0%CVE-2021-24946—Modern Events Calendar < 6.1.5 - Unauthenticated Blind SQL InjectionEPSS 72.8%CVE-2022-0364—Modern Events Calendar Lite < 6.4.0 - Contributor+ Stored Cross Site ScriptingEPSS 69.6%CVE-2021-24146—Modern Events Calendar Lite < 5.16.5 - Unauthenticated Events ExportEPSS 31.0%CVE-2021-24149—Modern Events Calendar Lite < 5.16.6 - Authenticated SQL InjectionEPSS 1.5%CVE-2021-24147—Modern Events Calendar Lite < 5.16.5 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 0.7%