CVE-2023-1400: Modern Events Calendar lite < 6.5.2 - Admin+ Stored XSS
The Modern Events Calendar Lite WordPress plugin before 6.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup).
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-1400?
CVE-2023-1400 is a vulnerability in the Modern Events Calendar Lite WordPress plugin before version 6.5.2.
What is the severity of CVE-2023-1400?
CVE-2023-1400 has a severity rating of 4.8 (medium).
How can CVE-2023-1400 be exploited?
CVE-2023-1400 can be exploited by high privilege users, such as admin, to perform Stored Cross-Site Scripting attacks.
Can CVE-2023-1400 be exploited even if the unfiltered_html capability is disallowed?
Yes, CVE-2023-1400 can be exploited even when the unfiltered_html capability is disallowed, for example in a multisite setup.
How can I fix CVE-2023-1400?
To fix CVE-2023-1400, update the Modern Events Calendar Lite WordPress plugin to version 6.5.2 or later.