Wordpress Modern Events Calendar Lite 跨站脚本漏洞

Wordpress Modern Events Calendar Lite is Wordpress open source plugin for an application. The plugin is used to manage the best tools for events website. A cross-site scripting vulnerability exists in the Modern Events Calendar Lite WordPress plugin versions prior to 5.16.5. The vulnerability ste...

Wordpress Modern Events Calendar Lite SQL注入漏洞

Wordpress Modern Events Calendar Lite is an open source application plugin for Wordpress. The plugin is used to manage the best tools for events website . Wordpress Modern Events Calendar Lite prior to version 5.16.6 suffers from a SQL injection vulnerability that originates from not clearing the...

Wordpress Modern Events Calendar Lite 访问控制错误漏洞

Wordpress Modern Events Calendar Lite is an open source application plugin for Wordpress. This plugin is the best tool for managing event websites. An access control error vulnerability exists in the WordPress Modern Events Calendar Lite plugin before 5.16.5, which stems from not properly...

Modern Events Calendar Lite < 5.16.5 - Authenticated Arbitrary File Upload leading to RCE

The plugin did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using the 'text/csv' content-type in the request. The issue could also be exploited via a CRSF attack, as such check was also missing...

Modern Events Calendar Lite < 5.16.5 - Unauthenticated Events Export

The plugin did not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format for example. PoC https://drive.google.com/file/d/1lLEXDyPp4LcKoCOqYS7A-0YgpIQD-ND/view?usp=sharing...

Modern Events Calendar Lite < 5.16.5 - Unauthenticated Events Export

The plugin did not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format for example. https://drive.google.com/file/d/1lLEXDyPp4LcKoCOqYS7A-0YgpIQD-ND/view?usp=sharing...

Wordpress Plugin Modern Events Calendar - Authenticated Remote Code Execution

This module allows an attacker with a privileged Wordpress account to launch a reverse shell due to an arbitrary file upload vulnerability in Wordpress plugin Modern Events Calendar .php Module Options msf use exploit/multi/http/wp/pluginmoderneventscalendarrce msf...

Modern Events Calendar Lite < 5.16.5 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin did not sanitise the miccomment field Notes on time when adding/editing an event, allowing users with privilege as low as author to add events with a Cross-Site Scripting payload in them, which will be triggered in the frontend when viewing the event. Edit WPScanTeam January 22nd, 2021...

WordPress Modern Events Calendar Lite plugin <= 5.16.2 - Authenticated Arbitrary File Upload to Remote Code Execution (RCE) vulnerability

Authenticated Arbitrary File Upload to Remote Code Execution RCE vulnerability found by Nguyen Van Khanh in WordPress Modern Events Calendar Lite plugin versions = 5.16.2. Solution Update the WordPress Modern Events Calendar Lite plugin to the latest available version at least 5.16.5...

Modern Events Calendar Lite < 5.16.5 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin did not sanitise the miccomment field Notes on time when adding/editing an event, allowing users with privilege as low as author to add events with a Cross-Site Scripting payload in them, which will be triggered in the frontend when viewing the event. Edit WPScanTeam January 22nd, 2021...

WordPress Modern Events Calendar Lite plugin <= 5.16.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability found by Nguyen Van Khanh in WordPress Modern Events Calendar Lite plugin versions = 5.16.2. Solution Update the WordPress Modern Events Calendar Lite plugin to the latest available version at least 5.16.5...

WordPress Modern Events Calendar Lite Plugin <= 5.1.6 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.113648";...

CVE-2020-9459

Multiple Stored Cross-site scripting XSS vulnerabilities in the Webnus Modern Events Calendar Lite plugin through 5.1.6 for WordPress allows remote authenticated users with minimal permissions to inject arbitrary JavaScript, HTML, or CSS via Ajax actions. This affects mecsavenotifications and...

CVE-2020-9459

Multiple Stored Cross-site scripting XSS vulnerabilities in the Webnus Modern Events Calendar Lite plugin through 5.1.6 for WordPress allows remote authenticated users with minimal permissions to inject arbitrary JavaScript, HTML, or CSS via Ajax actions. This affects mecsavenotifications and...

CVE-2020-9459

Vulnerability summary (CVE-2020-9459) : The WordPress plugin Modern Events Calendar Lite (versions up to 5.1.6) is affected by multiple stored XSS flaws. An authenticated user with minimal permissions can inject JavaScript/HTML/CSS via Ajax actions in affected endpoints, specifically through the ...

CVE-2020-9459

Multiple Stored Cross-site scripting XSS vulnerabilities in the Webnus Modern Events Calendar Lite plugin through 5.1.6 for WordPress allows remote authenticated users with minimal permissions to inject arbitrary JavaScript, HTML, or CSS via Ajax actions. This affects mecsavenotifications and...

Modern Events Calendar Lite < 5.1.7 - Multiple Subscriber+ Stored XSS

Modern Events Calendar Lite registers a number of AJAX actions for logged-in users. Some of these actions allow low-privileged users like subscribers to manipulate settings and other stored data. When exploited in this way, the affected data can be injected with various XSS payloads...

WordPress Modern Events Calendar Lite plugin <= 5.1.6 - Multiple Stored Cross-Site Scripting (XSS) Vulnerabilities

Multiple Stored Cross-Site Scripting XSS Vulnerabilities discovered by WordFence in WordPress Modern Events Calendar Lite plugin versions = 5.1.6. Solution Update the WordPress Modern Events Calendar Lite plugin to the latest available version at least 5.1.7...

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: I'm speaking at Indiana University Bloomington on January 30, 2020. I'll be at RSA Conference 2020 in San Francisco. On Wednesday, February 26, at 2:50 PM, I'll be part of a panel on "How to Reduce Supply Chain Risk: Lessons from...

WordPress The Events Calendar Plugin < 4.8.2 XSS Vulnerability

The WordPress plugin Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the...