Search
Find a vulnerability
Search criteria
6 vulnerabilities by webnus
CVE-2026-105067 (GCVE-0-2026-105067)
Vulnerability from cvelistv5 – Published: 2026-10-14 11:00 – Updated: 2026-10-15 15:08 X_Open Source
VLAI
EPSS
VEX
Title
WordPress Modern Events Calendar Lite plugin < 7.37.0 - SQL Injection vulnerability
Summary
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Webnus Modern Events Calendar Lite modern-events-calendar-lite allows Blind SQL Injection.This issue affects Modern Events Calendar Lite: from n/a before 7.37.0.
Severity
8.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 16:11 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
Patchstack
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Webnus | Modern Events Calendar Lite |
Affected:
0 , < 7.37.0
(custom)
|
Date Public
2026-10-12 10:52
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105067",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T16:11:30.657522Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:08:44.603Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "modern-events-calendar-lite",
"product": "Modern Events Calendar Lite",
"vendor": "Webnus",
"versions": [
{
"changes": [
{
"at": "7.37.0",
"status": "unaffected"
}
],
"lessThan": "7.37.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Aarush Gaur | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-10-12T10:52:54.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in Webnus Modern Events Calendar Lite modern-events-calendar-lite allows Blind SQL Injection.\u003cp\u003eThis issue affects Modern Events Calendar Lite: from n/a before 7.37.0.\u003c/p\u003e"
}
],
"value": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in Webnus Modern Events Calendar Lite modern-events-calendar-lite allows Blind SQL Injection.This issue affects Modern Events Calendar Lite: from n/a before 7.37.0."
}
],
"impacts": [
{
"capecId": "CAPEC-7",
"descriptions": [
{
"lang": "en",
"value": "Blind SQL Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T11:00:11.690Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/modern-events-calendar-lite/vulnerability/wordpress-modern-events-calendar-lite-plugin-7-37-0-sql-injection-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Modern Events Calendar Lite plugin to the latest available version (at least 7.37.0)."
}
],
"value": "Update the WordPress Modern Events Calendar Lite plugin to the latest available version (at least 7.37.0)."
}
],
"tags": [
"x_open-source"
],
"title": "WordPress Modern Events Calendar Lite plugin \u003c 7.37.0 - SQL Injection vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-105067",
"datePublished": "2026-10-14T11:00:11.690Z",
"dateReserved": "2026-10-03T00:17:03.678Z",
"dateUpdated": "2026-10-15T15:08:44.603Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-6522 (GCVE-0-2024-6522)
Vulnerability from cvelistv5 – Published: 2024-08-07 11:00 – Updated: 2026-04-08 16:32
VLAI
EPSS
VEX
Title
Modern Events Calendar <= 7.12.1 - Authenticated (Subscriber+) Server Side Request Forgery
Summary
The Modern Events Calendar plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.12.1 via the 'mec_fes_form' AJAX function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Severity
8.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-07 13:16 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
Wordfence
CNA
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Webnus | Modern Events Calendar |
Affected:
0 , ≤ 7.12.1
(semver)
|
|
| webnus/ | Modern Events Calendar Lite |
Affected:
0 , ≤ 7.12.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-6522",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-07T13:16:26.417078Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-07T13:17:59.476Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Modern Events Calendar",
"vendor": "Webnus",
"versions": [
{
"lessThanOrEqual": "7.12.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Modern Events Calendar Lite",
"vendor": "webnus/",
"versions": [
{
"lessThanOrEqual": "7.12.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Friderika Baranyai"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Modern Events Calendar plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.12.1 via the \u0027mec_fes_form\u0027 AJAX function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T16:32:23.620Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/00bf8f2f-6ab4-4430-800b-5b97abe7589e?source=cve"
},
{
"url": "https://wordpress.org/plugins/modern-events-calendar-lite/#developers"
},
{
"url": "https://plugins.trac.wordpress.org/browser/modern-events-calendar-lite/trunk/app/features/fes.php#L54"
},
{
"url": "https://mec.webnus.net/change-log/"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-08-06T21:57:41.000Z",
"value": "Disclosed"
}
],
"title": "Modern Events Calendar \u003c= 7.12.1 - Authenticated (Subscriber+) Server Side Request Forgery"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-6522",
"datePublished": "2024-08-07T11:00:06.508Z",
"dateReserved": "2024-07-04T21:05:30.723Z",
"dateUpdated": "2026-04-08T16:32:23.620Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-5441 (GCVE-0-2024-5441)
Vulnerability from cvelistv5 – Published: 2024-07-09 05:34 – Updated: 2026-04-08 16:34
VLAI
EPSS
VEX
Title
Modern Events Calendar <= 7.11.0 - Authenticated (Subscriber+) Arbitrary File Upload
Summary
The Modern Events Calendar plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_featured_image function in all versions up to, and including, 7.11.0. This makes it possible for authenticated attackers, with subscriber access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The plugin allows administrators (via its settings) to extend the ability to submit events to unauthenticated users, which would allow unauthenticated attackers to exploit this vulnerability.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-09 15:56 UTC
CWE
- CWE-434 - Unrestricted Upload of File with Dangerous Type
Assigner
Wordfence
CNA
References
2 references
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Webnus | Modern Events Calendar |
Affected:
0 , ≤ 7.11.0
(semver)
|
|
| webnus/ | Modern Events Calendar Lite |
Affected:
0 , ≤ 7.11.0
(semver)
|
|
| webnus | modern_events_calendar_lite |
Affected:
0 , ≤ 7.11.0
(semver)
cpe:2.3:a:webnus:modern_events_calendar_lite:*:*:*:*:*:wordpress:*:* |
|
| webnus | modern_events_calendar |
Affected:
0 , ≤ 7.11.0
(semver)
cpe:2.3:a:webnus:modern_events_calendar:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:webnus:modern_events_calendar_lite:*:*:*:*:*:wordpress:*:*"
],
"defaultStatus": "unknown",
"product": "modern_events_calendar_lite",
"vendor": "webnus",
"versions": [
{
"lessThanOrEqual": "7.11.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:webnus:modern_events_calendar:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "modern_events_calendar",
"vendor": "webnus",
"versions": [
{
"lessThanOrEqual": "7.11.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-5441",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-09T15:56:59.672680Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-09T20:44:19.612Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T21:11:12.734Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0c007090-9d9b-4ee7-8f77-91abd4373051?source=cve"
},
{
"tags": [
"x_transferred"
],
"url": "https://webnus.net/modern-events-calendar/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Modern Events Calendar",
"vendor": "Webnus",
"versions": [
{
"lessThanOrEqual": "7.11.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Modern Events Calendar Lite",
"vendor": "webnus/",
"versions": [
{
"lessThanOrEqual": "7.11.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Friderika Baranyai"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Modern Events Calendar plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_featured_image function in all versions up to, and including, 7.11.0. This makes it possible for authenticated attackers, with subscriber access and above, to upload arbitrary files on the affected site\u0027s server which may make remote code execution possible. The plugin allows administrators (via its settings) to extend the ability to submit events to unauthenticated users, which would allow unauthenticated attackers to exploit this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T16:34:58.038Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0c007090-9d9b-4ee7-8f77-91abd4373051?source=cve"
},
{
"url": "https://webnus.net/modern-events-calendar/"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-07-08T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "Modern Events Calendar \u003c= 7.11.0 - Authenticated (Subscriber+) Arbitrary File Upload"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-5441",
"datePublished": "2024-07-09T05:34:17.609Z",
"dateReserved": "2024-05-28T18:48:42.409Z",
"dateUpdated": "2026-04-08T16:34:58.038Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-30533 (GCVE-0-2022-30533)
Vulnerability from cvelistv5 – Published: 2022-06-16 01:35 – Updated: 2024-08-03 06:48
VLAI
EPSS
VEX
Summary
Cross-site scripting vulnerability in Modern Events Calendar Lite versions prior to 6.3.0 allows remote an authenticated attacker to inject an arbitrary script via unspecified vectors.
Severity
No CVSS data available.
CWE
- Cross-site scripting
Assigner
jpcert
CNA
References
2 references
| URL | Tags |
|---|---|
| https://webnus.net/modern-events-calendar/lite/ | x_refsource_MISC |
| https://jvn.jp/en/jp/JVN04155116/index.html | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Webnus | Modern Events Calendar Lite |
Affected:
versions prior to 6.3.0
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T06:48:36.370Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://webnus.net/modern-events-calendar/lite/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN04155116/index.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Modern Events Calendar Lite",
"vendor": "Webnus",
"versions": [
{
"status": "affected",
"version": "versions prior to 6.3.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting vulnerability in Modern Events Calendar Lite versions prior to 6.3.0 allows remote an authenticated attacker to inject an arbitrary script via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-site scripting",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-16T01:35:18.000Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://webnus.net/modern-events-calendar/lite/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://jvn.jp/en/jp/JVN04155116/index.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vultures@jpcert.or.jp",
"ID": "CVE-2022-30533",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Modern Events Calendar Lite",
"version": {
"version_data": [
{
"version_value": "versions prior to 6.3.0"
}
]
}
}
]
},
"vendor_name": "Webnus"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting vulnerability in Modern Events Calendar Lite versions prior to 6.3.0 allows remote an authenticated attacker to inject an arbitrary script via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross-site scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://webnus.net/modern-events-calendar/lite/",
"refsource": "MISC",
"url": "https://webnus.net/modern-events-calendar/lite/"
},
{
"name": "https://jvn.jp/en/jp/JVN04155116/index.html",
"refsource": "MISC",
"url": "https://jvn.jp/en/jp/JVN04155116/index.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2022-30533",
"datePublished": "2022-06-16T01:35:18.000Z",
"dateReserved": "2022-05-26T00:00:00.000Z",
"dateUpdated": "2024-08-03T06:48:36.370Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-27848 (GCVE-0-2022-27848)
Vulnerability from cvelistv5 – Published: 2022-04-14 20:05 – Updated: 2026-04-28 16:07
VLAI
EPSS
VEX
Title
WordPress Modern Events Calendar Lite plugin <= 6.5.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Summary
Authenticated (admin+ user) Stored Cross-Site Scripting (XSS) in Modern Events Calendar Lite (WordPress plugin) <= 6.5.1
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-20 19:31 UTC
CWE
- CWE-79 - Cross-site Scripting (XSS)
Assigner
Patchstack
CNA
References
2 references
| URL | Tags |
|---|---|
| https://wordpress.org/plugins/modern-events-calen… | x_refsource_CONFIRM |
| https://patchstack.com/database/vulnerability/mod… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Webnus | Modern Events Calendar Lite (WordPress plugin) |
Affected:
<= 6.5.1 , ≤ 6.5.1
(custom)
|
Date Public
2022-04-14 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T05:41:10.122Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://wordpress.org/plugins/modern-events-calendar-lite/#developers"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://patchstack.com/database/vulnerability/modern-events-calendar-lite/wordpress-modern-events-calendar-lite-plugin-6-5-1-authenticated-stored-cross-site-scripting-xss-vulnerability"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-27848",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-20T19:31:38.111175Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-20T20:27:03.966Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Modern Events Calendar Lite (WordPress plugin)",
"vendor": "Webnus",
"versions": [
{
"lessThanOrEqual": "6.5.1",
"status": "affected",
"version": "\u003c= 6.5.1",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Vulnerability discovered by Muhammad Daffa (Patchstack Alliance)"
}
],
"datePublic": "2022-04-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Authenticated (admin+ user) Stored Cross-Site Scripting (XSS) in Modern Events Calendar Lite (WordPress plugin) \u003c= 6.5.1"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.4,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-28T16:07:39.805Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://wordpress.org/plugins/modern-events-calendar-lite/#developers"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://patchstack.com/database/vulnerability/modern-events-calendar-lite/wordpress-modern-events-calendar-lite-plugin-6-5-1-authenticated-stored-cross-site-scripting-xss-vulnerability"
}
],
"solutions": [
{
"lang": "en",
"value": "Update to 6.5.2 or higher version."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress Modern Events Calendar Lite plugin \u003c= 6.5.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "audit@patchstack.com",
"DATE_PUBLIC": "2022-04-14T12:48:00.000Z",
"ID": "CVE-2022-27848",
"STATE": "PUBLIC",
"TITLE": "WordPress Modern Events Calendar Lite plugin \u003c= 6.5.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Modern Events Calendar Lite (WordPress plugin)",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "\u003c= 6.5.1",
"version_value": "6.5.1"
}
]
}
}
]
},
"vendor_name": "Webnus"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Vulnerability discovered by Muhammad Daffa (Patchstack Alliance)"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Authenticated (admin+ user) Stored Cross-Site Scripting (XSS) in Modern Events Calendar Lite (WordPress plugin) \u003c= 6.5.1"
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.4,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Cross-site Scripting (XSS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wordpress.org/plugins/modern-events-calendar-lite/#developers",
"refsource": "CONFIRM",
"url": "https://wordpress.org/plugins/modern-events-calendar-lite/#developers"
},
{
"name": "https://patchstack.com/database/vulnerability/modern-events-calendar-lite/wordpress-modern-events-calendar-lite-plugin-6-5-1-authenticated-stored-cross-site-scripting-xss-vulnerability",
"refsource": "CONFIRM",
"url": "https://patchstack.com/database/vulnerability/modern-events-calendar-lite/wordpress-modern-events-calendar-lite-plugin-6-5-1-authenticated-stored-cross-site-scripting-xss-vulnerability"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update to 6.5.2 or higher version."
}
],
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2022-27848",
"datePublished": "2022-04-14T20:05:48.495Z",
"dateReserved": "2022-03-24T00:00:00.000Z",
"dateUpdated": "2026-04-28T16:07:39.805Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
JVNDB-2022-000041
Vulnerability from jvndb - Published: 2022-06-01 04:39 - Updated:2024-06-18 01:42
Severity
Summary
WordPress Plugin "Modern Events Calendar Lite" vulnerable to cross-site scripting
Details
WordPress Plugin "Modern Events Calendar Lite" provided by Webnus contains a stored cross-site scripting vulnerability (CWE-79).
Tsutomu Aramaki of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
| Type | URL | |
|---|---|---|
Impacted products
| Vendor | Product | |
|---|---|---|
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-000041.html",
"dc:date": "2024-06-18T10:42+09:00",
"dcterms:issued": "2022-06-01T13:39+09:00",
"dcterms:modified": "2024-06-18T10:42+09:00",
"description": "WordPress Plugin \"Modern Events Calendar Lite\" provided by Webnus contains a stored cross-site scripting vulnerability (CWE-79).\r\n\r\nTsutomu Aramaki of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
"link": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-000041.html",
"sec:cpe": {
"#text": "cpe:/a:webnus:modern_events_calendar_lite",
"@product": "Modern Events Calendar Lite",
"@vendor": "Webnus",
"@version": "2.2"
},
"sec:cvss": [
{
"@score": "4.0",
"@severity": "Medium",
"@type": "Base",
"@vector": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"@version": "2.0"
},
{
"@score": "5.4",
"@severity": "Medium",
"@type": "Base",
"@vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"@version": "3.0"
}
],
"sec:identifier": "JVNDB-2022-000041",
"sec:references": [
{
"#text": "http://jvn.jp/en/jp/JVN04155116/index.html",
"@id": "JVN#04155116",
"@source": "JVN"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2022-30533",
"@id": "CVE-2022-30533",
"@source": "CVE"
},
{
"#text": "https://nvd.nist.gov/vuln/detail/CVE-2022-30533",
"@id": "CVE-2022-30533",
"@source": "NVD"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-79",
"@title": "Cross-site Scripting(CWE-79)"
}
],
"title": "WordPress Plugin \"Modern Events Calendar Lite\" vulnerable to cross-site scripting"
}