CVE-2023-1400

The CVE-2023-1400 entry concerns the WordPress plugin Modern Events Calendar Lite (pre-6.5.2). Root cause: the plugin does not sanitize/escape certain settings, enabling stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disallowed, including multisite contexts. Affect...

CVE-2023-1400 Modern Events Calendar lite < 6.5.2 - Admin+ Stored XSS

The Modern Events Calendar Lite WordPress plugin before 6.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...