Advisories · Technology
Modern Events Calendar Lite.
Every CVE that names Modern Events Calendar Lite among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.7 High
Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_attendees AJAX Action
- Modern Events Calendar Lite
- Modern Event Calendar Pro
- SQL injection
- CVSS 7.7 High
Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_fes_csv_export
- Modern Events Calendar Lite
- Modern Event Calendar Pro
- SQL injection
- CVSS 6.5 Medium
Modern Events Calendar Lite < 7.36.4 - Subscriber+ Arbitrary Post Modification via IDOR
- Modern Events Calendar Lite
- Broken access control
- CVSS 4.3 Medium
Modern Events Calendar Lite < 7.37.0 - Subscriber+ Sensitive Data Disclosure via mec_event_bookings and mec_attendees AJAX Actions
- Modern Events Calendar Lite
- Information disclosure
- CVSS 8.6 High
Modern Events Calendar (Lite & Pro) < 7.34.0 - Unauthenticated SQL Injection via mec_list_load_more
- Modern Event Calendar Pro
- Modern Events Calendar Lite
- SQL injection
- CVSS 4.8 Medium
Modern Events Calendar lite < 6.5.2 - Admin+ Stored XSS
- Modern Events Calendar Lite
-
Modern Events Calendar Lite < 6.4.0 - Contributor+ Stored Cross Site Scripting
- Modern Events Calendar Lite
- Cross-site scripting (XSS)
-
Modern Events Calendar Lite < 6.2.0 - Subscriber+ Category Add Leading to Stored XSS
- Modern Events Calendar Lite
- Cross-site scripting (XSS)
-
Modern Events Calendar < 6.1.5 - Unauthenticated Blind SQL Injection
- Modern Events Calendar Lite
- SQL injection
-
Modern Events Calendar Lite < 6.1.5 - Reflected Cross-Site Scripting
- Modern Events Calendar Lite
- Cross-site scripting (XSS)
-
Modern Events Calendar Lite < 5.22.3 - Authenticated Stored Cross Site Scripting
- Modern Events Calendar Lite
- Cross-site scripting (XSS)
-
Modern Events Calendar Lite < 5.22.2 - Admin+ Stored Cross-Site Scripting
- Modern Events Calendar Lite
- Cross-site scripting (XSS)
-
Modern Events Calendar Lite < 5.16.6 - Authenticated SQL Injection
- Modern Events Calendar Lite
- SQL injection
-
Modern Events Calendar Lite < 5.16.5 - Authenticated Stored Cross-Site Scripting (XSS)
- Modern Events Calendar Lite
- Cross-site scripting (XSS)
-
Modern Events Calendar Lite < 5.16.5 - Unauthenticated Events Export
- Modern Events Calendar Lite
- Broken access control
-
Modern Events Calendar Lite < 5.16.5 - Authenticated Arbitrary File Upload leading to RCE
- Modern Events Calendar Lite
- Unrestricted file upload