7.7
Élevée
CVE-2026-102499 The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0…
Description
The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL queries into already existing queries and extract sensitive data from the database.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Modern Events Calendar Lite 7.37 | premières → < 7.37.0 | 7.37.0 |
| Modern Event Calendar Pro 7.37 | premières → < 7.37.0 | 7.37.0 |
Autres CVE de Modern Events Calendar Lite
Les 16 CVE de Modern Events Calendar Lite →
CVE-2026-96534
The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0…
7.7
Élevée
CVE-2026-110070
The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the…
6.5
Moyenne
CVE-2026-110069
The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks…
4.3
Moyenne
CVE-2026-11349
The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0…
8.6
Élevée