Not rated
CVE-2021-24925 The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the current_month_divider…
Description
The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the current_month_divider parameter of its mec_list_load_more AJAX call (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Modern Events Calendar Lite 6.1 | earliest → < 6.1.5 | 6.1.5 |
Other CVEs of Modern Events Calendar Lite
The 16 CVEs of Modern Events Calendar Lite →
CVE-2026-102499
The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0…
7.7
High
CVE-2026-96534
The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0…
7.7
High
CVE-2026-110070
The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the…
6.5
Medium
CVE-2026-110069
The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks…
4.3
Medium