CVE-2026-102499

The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL...

CVE-2026-102499 Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_attendees AJAX Action

The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL...

CVE-2026-102499

The Modern Events Calendar Lite and Modern Event Calendar Pro WordPress plugins, in versions prior to 7.37.0 , are vulnerable to SQL injection . The root cause is the failure to sanitize and escape a parameter before using it in a SQL statement, specifically via the mec_attendees AJAX Action . Th...

EUVD-2026-107049

The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL...

PT-2026-120444

The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL...

CVE-2026-11349

Modern Events Calendar Lite = 7.33.0 — Unauthenticated SQL Injection via meclistloadmore attsinclude / attsexclude Summary Detail| Value ---|--- Plugin| Modern Events Calendar Lite Slug| modern-events-calendar-lite Author| Webnus Affected| = 7.33.0 the current vendor-distributed Lite release. Bug...

WordPress Modern Events Calendar Lite <5.16.5 - Sensitive Information Disclosure

WordPress Modern Events Calendar Lite before 5.16.5 does not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format. id: CVE-2021-24146 info: name: WordPress Modern Events Calendar Lite 5.16.5 - Sensitive Information Disclosure...

WordPress Modern Events Calendar Lite plugin < 7.37.0 - Subscriber+ SQLi vulnerability

Subscriber+ SQLi vulnerability discovered by Sanjar Tulkinov in WordPress Plugin Modern Events Calendar Lite versions 7.37.0...

CVE-2021-24145

CVE-2021-24145 WordPress File Upload Vulnerability, Modern Events Calendar Lite WordPress plugin before 5.16.5 https://nvd.nist.gov/vuln/detail/CVE-2021-24145 Installation and Execution Steps 1. WordPress Installation When proceeding with installation, please perform port forwarding in the...

WordPress Modern Events Calendar <6.1.5 - Blind SQL Injection

WordPress Modern Events Calendar plugin before 6.1.5 is susceptible to blind SQL injection. The plugin does not sanitize and escape the time parameter before using it in a SQL statement in the mecloadsinglepage AJAX action. An attacker can possibly obtain sensitive information, modify data, and/o...

CVE-2026-96534

The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing authenticated users with minimal privileges Subscriber and above to perform SQL injection...

CVE-2026-110070

The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it, allowing authenticated users with the Subscriber role to modify the title, content, and excerpt of arbitrary posts, pages, and custom post types...

CVE-2026-110069

The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks before returning event booking and attendee data, allowing any authenticated user, including Subscribers, to disclose the names, email addresses, transaction IDs and payment...

CVE-2026-96534 Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_fes_csv_export

The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing authenticated users with minimal privileges Subscriber and above to perform SQL injection...

CVE-2026-96534 Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_fes_csv_export

The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing authenticated users with minimal privileges Subscriber and above to perform SQL injection...

EUVD-2026-103401

The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing authenticated users with minimal privileges Subscriber and above to perform SQL injection...

CVE-2026-96534

The Modern Events Calendar Lite and Modern Event Calendar Pro WordPress plugins, in versions prior to 7.37.0 , are vulnerable to SQL injection . The flaw occurs because the software fails to properly sanitise and escape a parameter before including it in a SQL statement, specifically via the mec_...

CVE-2026-110069 Modern Events Calendar Lite < 7.37.0 - Subscriber+ Sensitive Data Disclosure via mec_event_bookings and mec_attendees AJAX Actions

The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks before returning event booking and attendee data, allowing any authenticated user, including Subscribers, to disclose the names, email addresses, transaction IDs and payment...

CVE-2026-110070 Modern Events Calendar Lite < 7.36.4 - Subscriber+ Arbitrary Post Modification via IDOR

The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it, allowing authenticated users with the Subscriber role to modify the title, content, and excerpt of arbitrary posts, pages, and custom post types...

CVE-2026-110069 Modern Events Calendar Lite < 7.37.0 - Subscriber+ Sensitive Data Disclosure via mec_event_bookings and mec_attendees AJAX Actions

The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks before returning event booking and attendee data, allowing any authenticated user, including Subscribers, to disclose the names, email addresses, transaction IDs and payment...