CVE-2021-24925: Modern Events Calendar Lite < 6.1.5 - Reflected Cross-Site Scripting
Published Dec 13, 2021
·Updated
The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the currentmonthdivider parameter of its meclistloadmore AJAX call (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue
Affected Software
1 affected component
Webnus Modern Events Calendar Lite Wordpress<6.1.5
Event History
Dec 13, 2021
CVE Published
via MITRE·10:41 AM
Data Sourced
via MITRE·10:41 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2021-24925.
2
What is the affected software?
The affected software is Webnus Modern Events Calendar Lite plugin for WordPress versions up to and excluding 6.1.5.
3
What is the severity of CVE-2021-24925?
The severity of CVE-2021-24925 is medium with a CVSS score of 6.1.
4
What is the impact of this vulnerability?
This vulnerability allows for reflected cross-site scripting (XSS) attacks.
5
How can I fix CVE-2021-24925?
Update the Webnus Modern Events Calendar Lite plugin to version 6.1.5 or later to fix this vulnerability.