EUVD-2021-34683Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | An attacker can extract, modify, or delete database contents, potentially gaining access to sensitive data or administrative credentials. With a CVSS score of 5.9 (MEDIUM), this represents a moderate risk. |
| Exploit ScenarioDerived | An attacker crafts a malicious input containing SQL metacharacters (e.g., ' OR 1=1 --) to manipulate database queries, bypass authentication, or exfiltrate data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 16, 2026
The Modern Events Calendar Lite plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'wp_ajax_mec_load_single_page' AJAX action in all versions up to, and including, 6.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable on sites with addslashes disabled.
Earlier versions of this analysis (1)
RemediationAI
A vendor patch is available — apply it immediately. Use parameterized queries or prepared statements. Apply input validation and escape special characters. Implement least-privilege database accounts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SQL injection occurs when user-supplied input is incorporated into SQL queries without proper sanitization or parameterized queries.
Know when Modern Events Calendar Lite gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2Executive ViewAI
Organizations using all should be aware of moderate risk from CVE-2021-4458, a SQL injection vulnerability rated CVSS 5.9. Exploitation could allow attackers to execute code or inject malicious input. A patch is available and should be applied during regular vulnerability management.
Apply vendor patch. If patching is delayed: deploy WAF rules, restrict network access, enable logging.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Modern Events Calendar Lite
View allArbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly chec
The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before usi
Unvalidated input in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.6, did not sanitise the mec[
The Modern Events Calendar plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validat
Unauthenticated SQL injection in the Modern Event Calendar Pro and Modern Events Calendar Lite WordPress plugins (all ve
Authenticated SQL injection in the Modern Events Calendar Lite and Modern Event Calendar Pro WordPress plugins before ve
SQL injection in Modern Events Calendar Lite and Pro versions before 7.37.0 allows authenticated users with Subscriber-l
Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not proper
Authenticated Subscriber-level users on WordPress sites running Modern Events Calendar Lite before 7.36.4 can modify the
The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the current_month_divider par
The Modern Events Calendar plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and
The Modern Events Calendar Lite WordPress plugin before 6.4.0 does not sanitize and escape some of the Hourly Schedule p
GitHub PoC
Exploit-DB