Modern Events Calendar Lite < 6.4.0 - Contributor+ Stored Cross Site Scripting
15Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 70%
exploitation probability
70%top 1% of all CVEs
observed exploitation
nono source reports it
The Modern Events Calendar Lite WordPress plugin before 6.4.0 does not sanitize and escape some of the Hourly Schedule parameters which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
Affected products
Unknown · Modern Events Calendar Lite