CVE-2021-24687: Modern Events Calendar Lite < 5.22.2 - Admin+ Stored Cross-Site Scripting
The Modern Events Calendar Lite WordPress plugin before 5.22.2 does not escape some of its settings before outputting them in attributes, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-24687?
CVE-2021-24687 is a vulnerability in the Modern Events Calendar Lite WordPress plugin before version 5.22.2, which allows high privilege users to perform Cross-Site Scripting (XSS) attacks.
How severe is CVE-2021-24687?
CVE-2021-24687 has a severity rating of 4.8, which is considered medium.
What is affected by CVE-2021-24687?
The vulnerability affects the Modern Events Calendar Lite WordPress plugin version up to 5.22.2.
How can an attacker exploit CVE-2021-24687?
An attacker can exploit CVE-2021-24687 by injecting malicious code into certain settings of the plugin, which will be executed in a victim's browser when the settings are rendered.
Is there a fix for CVE-2021-24687?
Yes, the vulnerability has been fixed in version 5.22.2 of the Modern Events Calendar Lite WordPress plugin.