Non notée
CVE-2021-24147 Unvalidated input and lack of output encoding in the Modern Events Calendar Lite WordPress plugin, versions before…
Description
Unvalidated input and lack of output encoding in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not sanitise the mic_comment field (Notes on time) when adding/editing an event, allowing users with privilege as low as author to add events with a Cross-Site Scripting payload in them, which will be triggered in the frontend when viewing the event.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Modern Events Calendar Lite 5.16 | premières → < 5.16.5 | 5.16.5 |
Autres CVE de Modern Events Calendar Lite
Les 16 CVE de Modern Events Calendar Lite →
CVE-2026-102499
The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0…
7.7
Élevée
CVE-2026-96534
The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0…
7.7
Élevée
CVE-2026-110070
The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the…
6.5
Moyenne
CVE-2026-110069
The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks…
4.3
Moyenne