CVE-2021-4458

< 6.4.0

The Modern Events Calendar Lite plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'wp_ajax_mec_loa

5.9MEDIUM

CVE-2024-6522

< 7.13.0

The Modern Events Calendar plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including,

8.5HIGH

CVE-2024-5441

<= 6.5.6

The Modern Events Calendar plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the

8.8HIGH

CVE-2023-4021

< 7.1.0

The Modern Events Calendar lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Google API key and Calendar

4.4MEDIUM

CVE-2023-1400

< 6.5.2

The Modern Events Calendar Lite WordPress plugin before 6.5.2 does not sanitise and escape some of its settings, which could allow

4.8MEDIUM

CVE-2022-30533

< 6.3.0

Cross-site scripting vulnerability in Modern Events Calendar Lite versions prior to 6.3.0 allows remote an authenticated attacker

5.4MEDIUM

CVE-2022-27848

<= 6.5.1

Authenticated (admin+ user) Stored Cross-Site Scripting (XSS) in Modern Events Calendar Lite (WordPress plugin) <= 6.5.1

3.4LOW

CVE-2022-0364

< 6.4.0

The Modern Events Calendar Lite WordPress plugin before 6.4.0 does not sanitize and escape some of the Hourly Schedule parameters

5.4MEDIUM

CVE-2021-25046

< 6.2.0

The Modern Events Calendar Lite WordPress plugin before 6.2.0 alloed any logged-in user, even a subscriber user, may add a categor

5.4MEDIUM

CVE-2021-24946

< 6.1.5

The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before using it in a

9.8CRITICAL

CVE-2021-24925

< 6.1.5

The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the current_month_divider parameter of

6.1MEDIUM

CVE-2021-24716

< 5.22.3

The Modern Events Calendar Lite WordPress plugin before 5.22.3 does not properly sanitize or escape values set by users with acces

5.4MEDIUM

CVE-2021-24687

< 5.22.2

The Modern Events Calendar Lite WordPress plugin before 5.22.2 does not escape some of its settings before outputting them in attr

4.8MEDIUM

CVE-2021-24149

< 5.16.6

Unvalidated input in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.6, did not sanitise the mec[post_id] P

8.8HIGH

CVE-2021-24147

< 5.16.5

Unvalidated input and lack of output encoding in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not

5.4MEDIUM

CVE-2021-24146

< 5.16.5

Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restric

7.5HIGH

CVE-2021-24145

< 5.16.5

Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the impo

7.2HIGH

CVE-2020-9459

<= 5.1.6

Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite plugin through 5.1.6 for Word

5.4MEDIUM