Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Modern Events Calendar Lite 6.1.5 Clear all filters
TI-2021-07225 CVE-2021-24946 · GHSA-8cmg-w5hw-x6p6

Modern Events Calendar < 6.1.5 - Unauthenticated Blind SQL Injection

Priority HIGH 80

The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX action, available to unauthenticated users…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.728 Published 2021-12-13 Fixed in 6.1.5 CWE-89
TI-2021-07205 CVE-2021-24925 · GHSA-jcvw-97r9-7cg7

Modern Events Calendar Lite < 6.1.5 - Reflected Cross-Site Scripting

Priority LOW 29

The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the current_month_divider parameter of its mec_list_load_more AJAX call (available to both unauthenticated and authenticated user…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00822 Published 2021-12-13 Fixed in 6.1.5 CWE-79