CVE-2021-24145

CVE-2021-24145 WordPress文件上传漏洞，Modern Events Calendar Lite WordPress插件5.16.5之前版本 https://nvd.nist.gov/vuln/detail/CVE-2021-24145 安装与运行顺序 1. WordPress安装 进行安装时，请从docker-compose.yml文件中进行端口转发。 root@kitploit: $ docker-compose up 2. WordPress初始化及插件安装 前往 http://web服务器ip:端口/ 进行基本安装。 前往 插件 - 添加新 - 上传插件。...

WordPress Modern Events Calendar Lite <5.16.5 - Authenticated Arbitrary File Upload

WordPress Modern Events Calendar Lite plugin before 5.16.5 is susceptible to authenticated arbitrary file upload. The plugin does not properly check the imported file, allowing PHP files to be uploaded and/or executed by an administrator or other high-privilege user using the text/csv content-typ...

WordPress Modern Events Calendar Lite <5.16.5 - Sensitive Information Disclosure

WordPress Modern Events Calendar Lite before 5.16.5 does not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format. id: CVE-2021-24146 info: name: WordPress Modern Events Calendar Lite 5.16.5 - Sensitive Information Disclosure...

WordPress Modern Events Calendar <6.1.5 - Blind SQL Injection

WordPress Modern Events Calendar plugin before 6.1.5 is susceptible to blind SQL injection. The plugin does not sanitize and escape the time parameter before using it in a SQL statement in the mecloadsinglepage AJAX action. An attacker can possibly obtain sensitive information, modify data, and/o...

CVE-2026-11349

Modern Events Calendar Lite getresults 执行，且未使用 。 由于入口点注册在 wpajaxnopriv 上，不需要认证、账户、nonce 或用户交互 。未认证的远程攻击者可以将任意 SQL 注入到针对 wpmecdates 表的 SELECT 语句的 WHERE 子句中，并通过盲时间/布尔/报错技术读取 WordPress 数据库中的任何数据（用户密码哈希、wpoptions 秘密/密钥、其他插件的数据）。 根因 1. “清理器”在默认路径上未进行任何清理 app/libraries/main.php:9607： root@kitpl...

CVE-2026-73339

Unauthenticated SQL Injection in Modern Events Calendar 7.35.0 versions...

CVE-2026-73339 WordPress Modern Events Calendar plugin < 7.35.0 - SQL Injection vulnerability

Unauthenticated SQL Injection in Modern Events Calendar 7.35.0 versions...

CVE-2026-73339

Affected product: Modern Events Calendar plugin for WordPress. Root cause: SQL injection vulnerability exploitable without authentication in versions below 7.35.0. Impact: CVSS 9.3 (CRITICAL), network-exploitable with no privileges or user interaction, enabling high confidentiality impact. Remedi...

EUVD-2026-60770

Unauthenticated SQL Injection in Modern Events Calendar 7.35.0 versions...

CVE-2026-73339 WordPress Modern Events Calendar plugin < 7.35.0 - SQL Injection vulnerability

Unauthenticated SQL Injection in Modern Events Calendar 7.35.0 versions...

CVE-2026-73339

Unauthenticated SQL Injection in Modern Events Calendar 7.35.0 versions...

PT-2026-77085

Unauthenticated SQL Injection in Modern Events Calendar 7.35.0 versions...

CVE-2026-11349 Modern Events Calendar (Lite & Pro) < 7.34.0 - Unauthenticated SQL Injection via mec_list_load_more

The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request parameter before using it in a SQL statement, through an AJAX action available to unauthenticated users, leading to an unauthenticated SQL...

CVE-2026-11349

The CVE concerns the Modern Event Calendar plugins for WordPress (Pro and Lite) before version 7.34.0, where an unauthenticated AJAX action uses an unsanitized request parameter in a SQL statement, causing an unauthenticated SQL injection. Root cause: lack of sanitization/escaping of the paramete...

CVE-2026-32583

Missing Authorization vulnerability in Webnus Inc. Modern Events Calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Modern Events Calendar: from n/a through 7.29.0...

CVE-2026-32583

Missing Authorization vulnerability in Webnus Inc. Modern Events Calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Modern Events Calendar: from n/a through 7.29.0...

CVE-2026-32583

CVE-2026-32583 describes a broken access control in the Webnus Webnus Modern Events Calendar (WordPress) where misconfigured access control levels allow bypassing authorization. Affected: Modern Events Calendar

CVE-2026-32583 WordPress Modern Events Calendar plugin <= 7.29.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Webnus Inc. Modern Events Calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Modern Events Calendar: from n/a through 7.29.0...

CVE-2026-32583 WordPress Modern Events Calendar plugin <= 7.29.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Webnus Inc. Modern Events Calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Modern Events Calendar: from n/a through 7.29.0...

WordPress Modern Events Calendar plugin <= 7.29.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Aman Rawat in WordPress Plugin Modern Events Calendar versions = 7.29.0...