CVE-2020-9459: XSS
Published Feb 28, 2020
·Updated
Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite plugin through 5.1.6 for WordPress allows remote authenticated users (with minimal permissions) to inject arbitrary JavaScript, HTML, or CSS via Ajax actions. This affects mecsavenotifications and importsettings.
Affected Software
1 affected component
Webnus Modern Events Calendar Lite Wordpress<=5.1.6
Event History
Feb 28, 2020
CVE Published
via MITRE·08:51 PM
Data Sourced
via MITRE·08:51 PM
Description
Data Sourced
via NVD·09:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the vulnerability ID of this security issue?
The vulnerability ID is CVE-2020-9459.
2
What is the severity level of CVE-2020-9459?
The severity level of CVE-2020-9459 is medium.
3
How does CVE-2020-9459 affect Webnus Modern Events Calendar Lite plugin?
CVE-2020-9459 allows remote authenticated users to inject arbitrary JavaScript, HTML, or CSS via Ajax actions.
4
What is the affected software and version of CVE-2020-9459?
The affected software is Webnus Modern Events Calendar Lite plugin through version 5.1.6 for WordPress.
5
How can I fix the XSS vulnerabilities in Webnus Modern Events Calendar Lite plugin?
Update the plugin to the latest version to mitigate the XSS vulnerabilities.