Lucene search
Krzysztof ZającWPEX-ID:82233588-6033-462D-B886-A8EF5EE9ADB0HistoryNov 15, 2021 - 12:00 a.m.
Modern Events Calendar Lite < 6.1.5 - Reflected Cross-Site Scripting
2021-11-1500:00:00
Krzysztof Zając
87
0.001 Low
EPSS
Percentile
44.3%
The plugin does not sanitise and escape the current_month_divider parameter of its mec_list_load_more AJAX call (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue
https://example.com/wp-admin/admin-ajax.php?action=mec_list_load_more¤t_month_divider=%3Cimg%20src%20onerror=alert(`XSS`);%3E&mec_start_date=1000-01-01Related
prion
prion
Cross site scripting
2021-12-13 11:15:00
cvelist
cvelist
cnvd
cnvd
WordPress Plugin Cross-Site Scripting Vulnerability (CNVD-2021-102799)
2021-12-15 00:00:00
wpvulndb
wpvulndb
Modern Events Calendar Lite < 6.1.5 - Reflected Cross-Site Scripting
2021-11-15 00:00:00
nvd
nvd
CVE-2021-24925
2021-12-13 11:15:09
cve
cve
CVE-2021-24925
2021-12-13 11:15:09
openvas
openvas