CVE-2021-24147: Modern Events Calendar Lite < 5.16.5 - Authenticated Stored Cross-Site Scripting (XSS)
Unvalidated input and lack of output encoding in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not sanitise the miccomment field (Notes on time) when adding/editing an event, allowing users with privilege as low as author to add events with a Cross-Site Scripting payload in them, which will be triggered in the frontend when viewing the event.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for the Modern Events Calendar Lite WordPress plugin? (CVE)
The vulnerability ID for the Modern Events Calendar Lite WordPress plugin is CVE-2021-24147.
What is the severity of CVE-2021-24147?
The severity of CVE-2021-24147 is medium, with a severity value of 5.4.
How does CVE-2021-24147 affect the Modern Events Calendar Lite plugin?
CVE-2021-24147 affects the Modern Events Calendar Lite plugin versions before 5.16.5.
What is the CWE (Common Weakness Enumeration) for CVE-2021-24147?
The CWE for CVE-2021-24147 is CWE-79 (Cross-site Scripting).
Is there a fix available for CVE-2021-24147?
Yes, the fix for CVE-2021-24147 is to update the Modern Events Calendar Lite plugin to version 5.16.5 or later.