Modern Events Calendar Lite < 6.1.5 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the current_month_divider parameter of its mec_list_load_more AJAX call (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue

PoC

https://example.com/wp-admin/admin-ajax.php?action=mec_list_load_more&amp;current;_month_divider=<img src onerror=alert(`XSS`);>&amp;mec;_start_date=1000-01-01