Vulnerabilities

TI-2024-06048 CVE-2024-6522 · GHSA-7846-r2fj-c4x4

Modern Events Calendar <= 7.12.1 - Authenticated (Subscriber+) Server Side Request Forgery

MEDIUM 41

The Modern Events Calendar plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.12.1 via the 'mec_fes_form' AJAX function.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00405 Published 2024-08-07 No fix listed CWE-918

TI-2024-05057 CVE-2024-5441 · GHSA-3f7w-7j77-73m5

Modern Events Calendar <= 7.11.0 - Authenticated (Subscriber+) Arbitrary File Upload

MEDIUM 42

The Modern Events Calendar plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_featured_image function in all versions up to, and including, 7.11.0.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01117 Published 2024-07-09 No fix listed CWE-434

Vulnerabilities

Filters

Modern Events Calendar <= 7.12.1 - Authenticated (Subscriber+) Server Side Request Forgery

Modern Events Calendar <= 7.11.0 - Authenticated (Subscriber+) Arbitrary File Upload