Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Modern Events Calendar Lite 5.16.5 Clear all filters
TI-2021-06439 CVE-2021-24147 · GHSA-38c2-7994-ggcm

Modern Events Calendar Lite < 5.16.5 - Authenticated Stored Cross-Site Scripting (XSS)

Priority LOW 26

Unvalidated input and lack of output encoding in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not sanitise the mic_comment field (Notes on time) when adding/editing an event, allowing use…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00748 Published 2021-03-18 Fixed in 5.16.5 CWE-79
TI-2021-06438 CVE-2021-24146 · GHSA-2qh8-fp5p-2xx2

Modern Events Calendar Lite < 5.16.5 - Unauthenticated Events Export

Priority MEDIUM 57

Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export files, allowing unauthenticated users to exports all events data in…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.31043 Published 2021-03-18 Fixed in 5.16.5 CWE-284
TI-2021-06437 CVE-2021-24145 · GHSA-5vmg-gchf-rcpm

Modern Events Calendar Lite < 5.16.5 - Authenticated Arbitrary File Upload leading to RCE

Priority HIGH 74

Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using the 'text/csv' conte…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.87201 Published 2021-03-18 Fixed in 5.16.5 CWE-434