Modern Events Calendar Lite
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:modern_events_calendar_lite:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Modern Events Calendar Lite (64c27104-afb6-5094-bf6e-37de7f0b2b86) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-110069 |
vulnerable | 2026-11-03 10:16:00.933932 |
Modern Events Calendar Lite < 7.37.0 - Subscriber+ Sensitive Data Disclosure via mec_event_bookings and mec_attendees AJAX Actions
The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks before returning event booking and attendee data, allowing any authenticated user, including Subscribers, to disclose the names, email addresses, transaction IDs and payment amounts of every booking on the site.
Published: 2026-10-18T06:00:16.169Z
Updated: 2026-10-18T11:12:30.423Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-110070 |
vulnerable | 2026-11-03 10:16:00.384361 |
Modern Events Calendar Lite < 7.36.4 - Subscriber+ Arbitrary Post Modification via IDOR
The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it, allowing authenticated users with the Subscriber role to modify the title, content, and excerpt of arbitrary posts, pages, and custom post types created by other users.
Published: 2026-10-18T06:00:16.343Z
Updated: 2026-10-18T11:12:30.273Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-102499 |
vulnerable | 2026-11-03 10:15:45.776708 |
Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_attendees AJAX Action
The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL queries into already existing queries and extract sensitive data from the database.
Published: 2026-10-21T06:00:16.646Z
Updated: 2026-10-21T10:35:09.296Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-96534 |
vulnerable | 2026-11-03 10:15:29.144196 |
Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_fes_csv_export
The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing authenticated users with minimal privileges (Subscriber and above) to perform SQL injection attacks.
Published: 2026-10-18T06:00:17.293Z
Updated: 2026-10-18T11:12:29.701Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-11349 |
vulnerable | 2026-07-29 00:23:30.956059 |
Modern Events Calendar (Lite & Pro) < 7.34.0 - Unauthenticated SQL Injection via mec_list_load_more
The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request parameter before using it in a SQL statement, through an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection vulnerability that allows attackers to extract sensitive data from the database.
Published: 2026-07-20T06:00:02.457Z
Updated: 2026-07-20T13:16:15.469Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-1400 |
vulnerable | 2026-06-08 05:52:35.770226 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-0364 |
vulnerable | 2026-06-08 05:39:09.889886 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-25046 |
vulnerable | 2026-06-08 05:30:39.858899 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24946 |
vulnerable | 2026-06-08 05:30:39.671589 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24925 |
vulnerable | 2026-06-08 05:30:39.631530 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24716 |
vulnerable | 2026-06-08 05:30:39.068868 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24687 |
vulnerable | 2026-06-08 05:30:39.011086 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24149 |
vulnerable | 2026-06-08 05:30:03.870102 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24147 |
vulnerable | 2026-06-08 05:30:03.867343 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24146 |
vulnerable | 2026-06-08 05:30:03.867000 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24145 |
vulnerable | 2026-06-08 05:30:03.856692 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.