Lucene search
Krzysztof ZającWPEX-ID:82233588-6033-462D-B886-A8EF5EE9ADB0HistoryNov 15, 2021 - 12:00 a.m.
Modern Events Calendar Lite < 6.1.5 - Reflected Cross-Site Scripting
2021-11-1500:00:00
Krzysztof Zając
103
modern events calendar
cross-site scripting
security vulnerability
wordpress
EPSS
0.002
Percentile
53.9%
The plugin does not sanitise and escape the current_month_divider parameter of its mec_list_load_more AJAX call (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue
https://example.com/wp-admin/admin-ajax.php?action=mec_list_load_more¤t_month_divider=%3Cimg%20src%20onerror=alert(`XSS`);%3E&mec_start_date=1000-01-01Related
cvelist
cvelist
prion
prion
Cross site scripting
2021-12-13 11:15:00
cnvd
cnvd
WordPress Plugin Cross-Site Scripting Vulnerability (CNVD-2021-102799)
2021-12-15 00:00:00
wpvulndb
wpvulndb
Modern Events Calendar Lite < 6.1.5 - Reflected Cross-Site Scripting
2021-11-15 00:00:00
cve
cve
CVE-2021-24925
2021-12-13 11:15:09
nvd
nvd
CVE-2021-24925
2021-12-13 11:15:09
openvas
openvas