Modern Events Calendar Lite < 6.1.5 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the current_month_divider parameter of its mec_list_load_more AJAX call (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue

https://example.com/wp-admin/admin-ajax.php?action=mec_list_load_more&current_month_divider=%3Cimg%20src%20onerror=alert(`XSS`);%3E&mec_start_date=1000-01-01