Modern Events Calendar Lite < 5.22.3 – Authenticated Stored Cross Site Scripting | CVE 2021-24716 | Plugin Vulnerabilities

Description

The plugin does not properly sanitize or escape values set by users with access to adjust settings withing wp-admin.

Proof of Concept

* Go to Setting Tab Under Calendar Lite Plugin
* Under Setting tab Click on Slugs/Permalinks tab
* Enter the XSS payload into Main Slug and Category Slug both. Both fields are vulnerable.
XSS payload used : "><script>alert(1)</script>
* Click On Save Changes. then visit to Setting tab again or reload it. XSS will popup.

Affects Plugins

modern-events-calendar-lite

Fixed in 5.22.3

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Shivam Rai

Submitter

Shivam Rai

Submitter twitter

Verified

Yes

WPVDB ID

576cc93d-1499-452b-97dd-80f69002e2a0

Timeline

Publicly Published

2021-09-29 (about 4 years ago)

Added

2021-09-29 (about 4 years ago)

Last Updated

2022-04-12 (about 3 years ago)

Other

Published

Title

Published

2025-01-16

Title

Network-Favorites <= 1.1 - Reflected Cross-Site Scripting

Published

2025-01-16

Title

Easy Bet <= 1.0.7 - Reflected Cross-Site Scripting

Published

2018-01-12

Title

Read and Understood <= 2.1 - Authenticated Stored XSS & CSRF

Published

2025-11-26

Title

Houzez < 4.1.7 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload

Published

2024-07-10

Title

Magical Addons For Elementor < 1.1.42 - Contributor+ Stored XSS