Modern Events Calendar Lite <= 5.1.6 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) Vulnerabilities

Subscriber

Published
2020-02-26

Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite plugin through 5.1.6 for WordPress allows remote authenticated users (with minimal permissions) to inject arbitrary JavaScript, HTML, or CSS via Ajax actions. This affects mec_save_notifications and import_settings.

CVE

https://www.cve.org/CVERecord?id=CVE-2020-9459

CVSS

Score:7.6

Severity:High

Version: 5.1.6

There is a patch available in v5.1.7 and we strongly recommend you update to this version as soon as possible.