Modern Event Calendar Pro
Monthly
Authenticated SQL injection in the Modern Events Calendar Lite and Modern Event Calendar Pro WordPress plugins before version 7.37.0 allows any logged-in user with Subscriber-level access or higher to append additional SQL clauses to an existing query and read sensitive data from the site's database. Only confidentiality is affected - the vulnerable code path provides no route to modify or delete data, and no user interaction is needed (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N per independent assessment). Publicly available exploit code exists, and the practical blast radius is largest on event, membership and community sites that permit open or self-service registration, where an attacker can simply sign up for a low-privilege account.
SQL injection in Modern Events Calendar Lite and Pro versions before 7.37.0 allows authenticated users with Subscriber-level access or higher to read arbitrary data from the WordPress database. Publicly available exploit code exists, though CISA's SSVC assessment finds no active exploitation; the practical barrier is the requirement for a valid low-privilege account, making this a credible mid-tier priority rather than an emergency.
Unauthenticated SQL injection in the Modern Event Calendar Pro and Modern Events Calendar Lite WordPress plugins (all versions before 7.34.0) lets remote attackers extract sensitive database contents by injecting into an unsanitized request parameter used within a SQL statement, reachable through an AJAX action open to unauthenticated users. Publicly available exploit code exists (reported by WPScan), and a vendor patch is available; the CVSS 8.6 rating reflects a scope-changed, high-confidentiality impact with no authentication or user interaction required. No EPSS score or CISA KEV listing was provided, so there is no public exploit identified as being actively exploited at time of analysis.
Authenticated SQL injection in the Modern Events Calendar Lite and Modern Event Calendar Pro WordPress plugins before version 7.37.0 allows any logged-in user with Subscriber-level access or higher to append additional SQL clauses to an existing query and read sensitive data from the site's database. Only confidentiality is affected - the vulnerable code path provides no route to modify or delete data, and no user interaction is needed (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N per independent assessment). Publicly available exploit code exists, and the practical blast radius is largest on event, membership and community sites that permit open or self-service registration, where an attacker can simply sign up for a low-privilege account.
SQL injection in Modern Events Calendar Lite and Pro versions before 7.37.0 allows authenticated users with Subscriber-level access or higher to read arbitrary data from the WordPress database. Publicly available exploit code exists, though CISA's SSVC assessment finds no active exploitation; the practical barrier is the requirement for a valid low-privilege account, making this a credible mid-tier priority rather than an emergency.
Unauthenticated SQL injection in the Modern Event Calendar Pro and Modern Events Calendar Lite WordPress plugins (all versions before 7.34.0) lets remote attackers extract sensitive database contents by injecting into an unsanitized request parameter used within a SQL statement, reachable through an AJAX action open to unauthenticated users. Publicly available exploit code exists (reported by WPScan), and a vendor patch is available; the CVSS 8.6 rating reflects a scope-changed, high-confidentiality impact with no authentication or user interaction required. No EPSS score or CISA KEV listing was provided, so there is no public exploit identified as being actively exploited at time of analysis.