Lucene search
WPScanCVELIST:CVE-2021-24147HistoryMar 18, 2021 - 2:57 p.m.
CVE-2021-24147 Modern Events Calendar Lite < 5.16.5 - Authenticated Stored Cross-Site Scripting (XSS)
2021-03-1814:57:50
CWE-79
WPScan
www.cve.org
0.001 Low
EPSS
Percentile
24.9%
Unvalidated input and lack of output encoding in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not sanitise the mic_comment field (Notes on time) when adding/editing an event, allowing users with privilege as low as author to add events with a Cross-Site Scripting payload in them, which will be triggered in the frontend when viewing the event.
CNA Affected
[
{
"product": "Modern Events Calendar Lite",
"vendor": "Unknown",
"versions": [
{
"lessThan": "5.16.5",
"status": "affected",
"version": "5.16.5",
"versionType": "custom"
}
]
}
]Related
wpvulndb
wpvulndb
osv
osv
CVE-2021-24147
2021-03-18 15:15:15
nvd
nvd
CVE-2021-24147
2021-03-18 15:15:15
wpexploit
wpexploit
cve
cve
CVE-2021-24147
2021-03-18 15:15:15
prion
prion
Cross site scripting
2021-03-18 15:15:00