CVE-2021-24147

🗓️ 18 Mar 2021 14:57:50Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 88 Views🌐 WEB

Unvalidated input and lack of output encoding in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not sanitise the mic_comment field (Notes on time) when adding/editing an event, allowing users with privilege as low as author to add events with a Cross-Site Scripting payload in them, which will be triggered in the frontend when viewing the event

Reporter	Title	Published	Views	Family All 14
attackerkb	CVE-2021-24147	18 Mar 202115:15	–	attackerkb
Circl	CVE-2021-24147	9 Nov 202315:39	–	circl
CNNVD	WordPress Modern Events Calendar Lite: Cross-site Script Vulnerability	18 Mar 202100:00	–	cnnvd
CNVD	Wordpress Modern Events Calendar Lite Cross-Site Scripting Vulnerability	22 Mar 202100:00	–	cnvd
Cvelist	CVE-2021-24147 Modern Events Calendar Lite < 5.16.5 - Authenticated Stored Cross-Site Scripting (XSS)	18 Mar 202114:57	–	cvelist
EUVD	EUVD-2021-11061	7 Oct 202500:30	–	euvd
NVD	CVE-2021-24147	18 Mar 202115:15	–	nvd
osv_cve	CVE-2021-24147	18 Mar 202115:15	–	osv_cve
Prion	Cross site scripting	18 Mar 202115:15	–	prion
Positive Technologies	PT-2021-15693	18 Mar 202100:00	–	ptsecurity

NVD

Vulners

Node

webnus modern_events_calendar_liteRange<5.16.5wordpress

[
  {
    "product": "Modern Events Calendar Lite",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "5.16.5",
        "status": "affected",
        "version": "5.16.5",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/0f9ba284-5d7e-4092-8344-c68316b0146f

Parameter	Position	Path	Description	CWE
mic_comment	request body	/wp-admin/admin.php	The mic_comment field (Notes on time) in the Modern Events Calendar Lite plugin is not sanitized when adding or editing an event, leading to stored XSS.	CWE-79

17 Jun 2026 03:39Current

5.9Medium risk

Vulners AI Score5.9

CVSS 23.5

CVSS 3.15.4

EPSS0.00748

CWE-79