7.7
High
CVE-2026-96534 The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0…
Description
The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing authenticated users with minimal privileges (Subscriber and above) to perform SQL injection attacks.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Modern Events Calendar Lite 7.37 | earliest → < 7.37.0 | 7.37.0 |
| Modern Event Calendar Pro 7.37 | earliest → < 7.37.0 | 7.37.0 |
Other CVEs of Modern Events Calendar Lite
The 16 CVEs of Modern Events Calendar Lite →
CVE-2026-102499
The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0…
7.7
High
CVE-2026-110070
The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the…
6.5
Medium
CVE-2026-110069
The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks…
4.3
Medium
CVE-2026-11349
The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0…
8.6
High