CVE-2024-6522

CVE-2024-6522 – Normal mode Affected software: Modern Events Calendar (WordPress) and Modern Events Calendar Lite. Root cause: Server-Side Request Forgery (SSRF) via the mec_fes_form AJAX function, affecting all versions up to 7.12.1. Impact: Authenticated attackers with Subscriber-level access a...

CVE-2024-5441

CVE-2024-5441 affects Modern Events Calendar (WordPress) up to 7.11.0. The vulnerability arises from missing file type validation in set_featured_image, enabling authenticated users with Subscriber+ to upload arbitrary files, potentially leading to remote code execution. Red Hat confirms the cond...