Modern Events Calendar Lite (Unknown) - vulnerabilities (CVEs)
16 CVEs, 4 in the last 30 days, 1 known versions, newest CVE from 2026-10-21. Vendor: Unknown.
CVEs of Modern Events Calendar Lite
- CVE-2026-102499 - CVSS 7.7 (high), 2026-10-21: The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a…
- CVE-2026-96534 - CVSS 7.7 (high), 2026-10-18: The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a…
- CVE-2026-110069 - CVSS 4.3 (medium), 2026-10-18: The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks before returning event booking and…
- CVE-2026-110070 - CVSS 6.5 (medium), 2026-10-18: The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it, allowing…
- CVE-2026-11349 - CVSS 8.6 (high), 2026-07-20: The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request…
- CVE-2023-1400 - CVSS 4.8 (medium), 2023-03-27: The Modern Events Calendar Lite WordPress plugin before 6.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such…
- CVE-2022-0364 - CVSS 5.4 (medium), 2022-03-21: The Modern Events Calendar Lite WordPress plugin before 6.4.0 does not sanitize and escape some of the Hourly Schedule parameters which could allow users with…
- CVE-2021-25046 - CVSS 5.4 (medium), 2022-01-17: The Modern Events Calendar Lite WordPress plugin before 6.2.0 alloed any logged-in user, even a subscriber user, may add a category whose parameters are…
- CVE-2021-24925 - CVSS 6.1 (medium), 2021-12-13: The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the current_month_divider parameter of its mec_list_load_more AJAX…
- CVE-2021-24946 - CVSS 9.8 (critical), 2021-12-13: The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before using it in a SQL statement in the…
- CVE-2021-24716 - CVSS 5.4 (medium), 2021-11-01: The Modern Events Calendar Lite WordPress plugin before 5.22.3 does not properly sanitize or escape values set by users with access to adjust settings withing…
- CVE-2021-24687 - CVSS 4.8 (medium), 2021-10-04: The Modern Events Calendar Lite WordPress plugin before 5.22.2 does not escape some of its settings before outputting them in attributes, allowing high…
- CVE-2021-24149 - CVSS 8.8 (high), 2021-03-18: Unvalidated input in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.6, did not sanitise the mec[post_id] POST parameter in the…
- CVE-2021-24147 - CVSS 5.4 (medium), 2021-03-18: Unvalidated input and lack of output encoding in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not sanitise the mic_comment…
- CVE-2021-24146 - CVSS 7.5 (high), 2021-03-18: Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export…
- CVE-2021-24145 - CVSS 7.2 (high), 2021-03-18: Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones…
