Skip to content
Sign in
Not rated

CVE-2021-24946 The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before…

Description

The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue

Affected products and versions

Product Affected versions Fixed in
Modern Events Calendar Lite 6.1 earliest → < 6.1.5 6.1.5

Other CVEs of Modern Events Calendar Lite

The 16 CVEs of Modern Events Calendar Lite →
CVE-2026-102499 The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0… 7.7 High CVE-2026-96534 The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0… 7.7 High CVE-2026-110070 The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the… 6.5 Medium CVE-2026-110069 The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks… 4.3 Medium
Track this CVE