243 matches found
CVE-2023-1400: Undefined Security Weakness
The Modern Events Calendar Lite WordPress plugin before 6.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
PT-2023-16957 · WordPress · Modern Events Calendar Lite
Name of the Vulnerable Software and Affected Versions: The Modern Events Calendar Lite WordPress plugin versions prior to 6.5.2 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowe...
Modern Events Calendar lite <= 5.16.2 - Admin+ Stored XSS
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. PoC 1. Go to the import/export section. 2. Enter...
WordPress Modern Events Calendar Lite Plugin Cross-Site Scripting (CVE-2022-0364)
A stored cross-site scripting vulnerability exists for the WordPress plugin Modern Events Calendar Lite. This vulnerability is due to improper input validation for multiple parameters in the Hourly Schedule section...
WordPress Modern Events Calendar Lite Plugin < 6.4.0 XSS Vulnerability
The WordPress plugin SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.126054";...
CVE-2022-30533
Cross-site scripting vulnerability in Modern Events Calendar Lite versions prior to 6.3.0 allows remote an authenticated attacker to inject an arbitrary script via unspecified vectors...
CVE-2022-30533
Cross-site scripting vulnerability in Modern Events Calendar Lite versions prior to 6.3.0 allows remote an authenticated attacker to inject an arbitrary script via unspecified vectors...
CVE-2022-30533
Cross-site scripting vulnerability in Modern Events Calendar Lite versions prior to 6.3.0 allows remote an authenticated attacker to inject an arbitrary script via unspecified vectors...
Cross site scripting
Cross-site scripting vulnerability in Modern Events Calendar Lite versions prior to 6.3.0 allows remote an authenticated attacker to inject an arbitrary script via unspecified vectors...
CVE-2022-30533
CVE-2022-30533 affects the WordPress Modern Events Calendar Lite plugin (versions before 6.3.0). Vulnerability type: authenticated stored cross-site scripting (XSS) in the plugin, enabling an authenticated attacker to inject arbitrary scripts that run in a victim’s browser via unspecified vectors...
CVE-2022-30533
Cross-site scripting vulnerability in Modern Events Calendar Lite versions prior to 6.3.0 allows remote an authenticated attacker to inject an arbitrary script via unspecified vectors...
CVE-2022-30533: Improper Neutralization of Input During Web Page Generation
Cross-site scripting vulnerability in Modern Events Calendar Lite versions prior to 6.3.0 allows remote an authenticated attacker to inject an arbitrary script via unspecified vectors...
Wordpress Modern Events Calendar Lite plugin cross-site scripting vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plug-in. A cross-site scripting vulnerability exists in the Wordpress Modern Events Calendar Lite plugin, which stems...
WordPress Plugin "Modern Events Calendar Lite" vulnerable to cross-site scripting
Overview WordPress Plugin "Modern Events Calendar Lite" provided by Webnus contains a stored cross-site scripting vulnerability CWE-79. Tsutomu Aramaki of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security...
JVN#04155116: WordPress Plugin "Modern Events Calendar Lite" vulnerable to cross-site scripting
WordPress Plugin "Modern Events Calendar Lite" provided by Webnus contains a stored cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the web browser of the user who is accessing the website using the plugin. Solution Update the plugin Update the plugin to t...
Modern Events Calendar Lite < 6.3.0 - Authenticated Stored Cross-Site Scripting
The plugin does not sanitise and escape some parameters, which could allow low privilege users to perform Stored Cross-Site Scripting attacks...
WordPress Modern Events Calendar Lite plugin < 6.3.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Tsutomu Aramaki Mitsui Bussan Secure Directions, Inc in WordPress Modern Events Calendar Lite plugin versions 6.3.0. Solution Fixed in version 6.3.0, but the plugin is closed. This plugin has been closed as of May 11, 2022...
Modern Events Calendar Lite 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plug-in. A cross-site scripting vulnerability exists in the Wordpress Modern Events Calendar Lite plugin, which stems...