Modern Event Calendar Pro
Monthly
Unauthenticated SQL injection in the Modern Event Calendar Pro and Modern Events Calendar Lite WordPress plugins (all versions before 7.34.0) lets remote attackers extract sensitive database contents by injecting into an unsanitized request parameter used within a SQL statement, reachable through an AJAX action open to unauthenticated users. Publicly available exploit code exists (reported by WPScan), and a vendor patch is available; the CVSS 8.6 rating reflects a scope-changed, high-confidentiality impact with no authentication or user interaction required. No EPSS score or CISA KEV listing was provided, so there is no public exploit identified as being actively exploited at time of analysis.
Unauthenticated SQL injection in the Modern Event Calendar Pro and Modern Events Calendar Lite WordPress plugins (all versions before 7.34.0) lets remote attackers extract sensitive database contents by injecting into an unsanitized request parameter used within a SQL statement, reachable through an AJAX action open to unauthenticated users. Publicly available exploit code exists (reported by WPScan), and a vendor patch is available; the CVSS 8.6 rating reflects a scope-changed, high-confidentiality impact with no authentication or user interaction required. No EPSS score or CISA KEV listing was provided, so there is no public exploit identified as being actively exploited at time of analysis.