WordPress Modern Events Calendar Lite plugin cross-site scripting vulnerability

WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. WordPress Modern Events Calendar Lite plugin has a cross-site scripting vulnerability in versions prior...

CVE-2021-24716

The Modern Events Calendar Lite WordPress plugin before 5.22.3 does not properly sanitize or escape values set by users with access to adjust settings withing wp-admin...

CVE-2021-24716

The Modern Events Calendar Lite WordPress plugin before 5.22.3 does not properly sanitize or escape values set by users with access to adjust settings withing wp-admin...

CVE-2021-24716 Modern Events Calendar Lite < 5.22.3 - Authenticated Stored Cross Site Scripting

The Modern Events Calendar Lite WordPress plugin before 5.22.3 does not properly sanitize or escape values set by users with access to adjust settings withing wp-admin...

CVE-2021-24716

CVE-2021-24716 affects the WordPress plugin Modern Events Calendar Lite prior to 5.22.3. The issue is an authenticated stored Cross-Site Scripting (XSS) vulnerability caused by inadequate sanitization/escaping of user input in wp-admin settings. Impact is client-side script execution if an attack...

CVE-2021-24716: Improper Neutralization of Input During Web Page Generation

The Modern Events Calendar Lite WordPress plugin before 5.22.3 does not properly sanitize or escape values set by users with access to adjust settings withing wp-admin...

PT-2021-16219

Name of the Vulnerable Software and Affected Versions The Modern Events Calendar Lite WordPress plugin versions prior to 5.22.3 Description The issue arises from the plugin's failure to properly sanitize or escape values set by users with access to adjust settings within wp-admin. This could...

WordPress 跨站脚本漏洞

WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. WordPress Modern Events Calendar Lite plugin has a cross-site scripting vulnerability in versions prior...

Registrations for The Events Calendar < 2.7.5 - Reflected Cross-Site Scripting

The plugin does not escape the v parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting https://example.com/wp-admin/admin.php?page=registrations-for-the-events-calendar&tab=registrations&v="+style=animation-name:rotation+onanimationstart=alert/XSS///...

WordPress Registrations for the Events Calendar plugin <= 2.7.4 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by JrXnm in WordPress Registrations for the Events Calendar plugin versions = 2.7.4. Solution Update the WordPress Registrations for the Events Calendar plugin to the latest available version at least 2.7.5...

VulnCheck KEV: CVE-2021-24876

The Registrations for the Events Calendar WordPress plugin before 2.7.5 does not escape the v parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting...

WordPress插件Modern Events Calendar Lite跨站脚本漏洞

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL.The WordPress plugin Modern Events Calendar Lite has a cross-site scripting vulnerability that stems fro...

CVE-2021-24687

The Modern Events Calendar Lite WordPress plugin before 5.22.2 does not escape some of its settings before outputting them in attributes, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24687

The Modern Events Calendar Lite WordPress plugin before 5.22.2 does not escape some of its settings before outputting them in attributes, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

Cross site scripting

The Modern Events Calendar Lite WordPress plugin before 5.22.2 does not escape some of its settings before outputting them in attributes, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24687

CVE-2021-24687 affects the WordPress plugin Modern Events Calendar Lite up to version 5.22.2. Multiple sources indicate a failure to escape certain settings before output in attributes, enabling Cross-Site Scripting (XSS) by high-privilege users, even when unfiltered_html is disallowed. The vulne...

PT-2021-16196

Name of the Vulnerable Software and Affected Versions The Modern Events Calendar Lite WordPress plugin versions prior to 5.22.2 Description The issue allows high privilege users to perform Cross-Site Scripting attacks due to the plugin not escaping some of its settings before outputting them in...

CVE-2021-24687: Improper Neutralization of Input During Web Page Generation

The Modern Events Calendar Lite WordPress plugin before 5.22.2 does not escape some of its settings before outputting them in attributes, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

WordPress Modern Events Calendar Lite plugin <= 5.22.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Shivam Rai in WordPress Modern Events Calendar Lite plugin versions = 5.22.2. Solution Update the WordPress Modern Events Calendar Lite plugin to the latest available version at least 5.22.3...

Modern Events Calendar Lite < 5.22.2 - Admin+ Stored Cross-Site Scripting

The plugin does not escape some of its settings before outputting them in attributes, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC Go to the plugin Settings Messages Taxonomies...