CVE-2021-25046: Modern Events Calendar Lite < 6.2.0 - Subscriber+ Category Add Leading to Stored XSS
The Modern Events Calendar Lite WordPress plugin before 6.2.0 alloed any logged-in user, even a subscriber user, may add a category whose parameters are incorrectly escaped in the admin panel, leading to stored XSS.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-25046?
CVE-2021-25046 is a vulnerability in the Modern Events Calendar Lite WordPress plugin that allows any logged-in user, even a subscriber user, to add a category with parameters that are incorrectly escaped, leading to stored XSS.
How severe is CVE-2021-25046?
CVE-2021-25046 has a severity rating of 5.4, which is considered medium.
What software versions are affected by CVE-2021-25046?
Versions of the Modern Events Calendar Lite WordPress plugin up to exclusive version 6.2.0 are affected by CVE-2021-25046.
What is the Common Weakness Enumeration (CWE) for CVE-2021-25046?
The CWE for CVE-2021-25046 is CWE-79, which refers to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
How can I fix CVE-2021-25046?
To fix CVE-2021-25046, update your Modern Events Calendar Lite WordPress plugin to version 6.2.0 or later.