Modern Events Calendar
Monthly
SQL injection in the Modern Events Calendar WordPress plugin (versions prior to 7.35.0 by Webnus Inc.) allows unauthenticated remote attackers to inject arbitrary SQL through user-supplied input, enabling extraction of sensitive database contents such as user credentials and secrets. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms this is remotely reachable with no authentication or user interaction, making it a high-priority patch. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Modern Events Calendar versions up to 7.29.0 contain an access control vulnerability that allows unauthenticated remote attackers to modify data through improperly configured authorization checks. This vulnerability enables attackers to perform unauthorized actions without authentication, affecting all installations of the affected versions. No patch is currently available, requiring organizations to implement alternative mitigation strategies.
The Modern Events Calendar plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.12.1 via the 'mec_fes_form' AJAX function. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Modern Events Calendar plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_featured_image function in all versions up to, and including,. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 19.7% and no vendor patch available.
SQL injection in the Modern Events Calendar WordPress plugin (versions prior to 7.35.0 by Webnus Inc.) allows unauthenticated remote attackers to inject arbitrary SQL through user-supplied input, enabling extraction of sensitive database contents such as user credentials and secrets. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms this is remotely reachable with no authentication or user interaction, making it a high-priority patch. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Modern Events Calendar versions up to 7.29.0 contain an access control vulnerability that allows unauthenticated remote attackers to modify data through improperly configured authorization checks. This vulnerability enables attackers to perform unauthorized actions without authentication, affecting all installations of the affected versions. No patch is currently available, requiring organizations to implement alternative mitigation strategies.
The Modern Events Calendar plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.12.1 via the 'mec_fes_form' AJAX function. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Modern Events Calendar plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_featured_image function in all versions up to, and including,. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 19.7% and no vendor patch available.