CVE-2021-24925

🗓️ 13 Dec 2021 10:41:20Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 52 Views🌐 WEB

The Modern Events Calendar Lite WordPress plugin before 6.1.5 is prone to Reflected Cross-Site Scripting issue

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2021-24925	13 Dec 202114:22	–	circl
CNNVD	WordPress 插件跨站脚本漏洞	13 Dec 202100:00	–	cnnvd
CNVD	WordPress plugin cross-site scripting vulnerability (CNVD-2021-102799)	15 Dec 202100:00	–	cnvd
Cvelist	CVE-2021-24925 Modern Events Calendar Lite < 6.1.5 - Reflected Cross-Site Scripting	13 Dec 202110:41	–	cvelist
EUVD	EUVD-2021-11837	7 Oct 202500:30	–	euvd
NVD	CVE-2021-24925	13 Dec 202111:15	–	nvd
OpenVAS	WordPress Modern Events Calendar Lite Plugin < 6.1.5 Multiple Vulnerabilities	18 Jan 202200:00	–	openvas
OSV	CVE-2021-24925	13 Dec 202111:15	–	osv
Prion	Cross site scripting	13 Dec 202111:15	–	prion
RedhatCVE	CVE-2021-24925	22 May 202520:32	–	redhatcve

NVD

Vulners

Node

webnus modern_events_calendar_liteRange<6.1.5wordpress

[
  {
    "product": "Modern Events Calendar Lite",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "6.1.5",
        "status": "affected",
        "version": "6.1.5",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/82233588-6033-462d-b886-a8ef5ee9adb0

Parameter	Position	Path	Description	CWE
current_month_divider	query param	wp-admin/admin-ajax.php	Reflected XSS via unsanitized current_month_divider parameter in mec_list_load_more AJAX call	CWE-79

21 Nov 2024 05:54Current

6.1Medium risk

Vulners AI Score6.1

CVSS 24.3

CVSS 3.16.1

EPSS0.00429

CWE-79