CVE-2023-4021: falha de média gravidade em webnus/ Modern Events Calendar Lite
Modern Events Calendar lite < 7.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.4epss 0.4%
The Modern Events Calendar lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Google API key and Calendar ID in versions up to, but not including, 7.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Produtos afetados
webnus/ · Modern Events Calendar LiteCVEs relacionadas — webnus/ Modern Events Calendar Lite
No mesmo produto, das mais perigosas para as menos.
CVE-2024-5441HIGHModern Events Calendar <= 7.11.0 - Authenticated (Subscriber+) Arbitrary File UploadEPSS 1.1%CVE-2024-6522HIGHModern Events Calendar <= 7.12.1 - Authenticated (Subscriber+) Server Side Request ForgeryEPSS 0.4%CVE-2021-4458MEDIUMModern Events Calendar Lite <= 6.3.0 - Unauthenticated SQL InjectionEPSS 0.4%CVE-2025-5733MEDIUMModern Events Calendar <= 7.21.9 - Information ExposureEPSS 0.4%