What’s Vulnerable › Products
Modern Events Calendar Lite vulnerabilities
25 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.
Check whether your Modern Events Calendar Lite version is affected
Latest Modern Events Calendar Lite vulnerabilities
- CVE-2026-102499 — Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_attendees AJAX Action (CVSS 7.7)
- CVE-2026-96534 — Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_fes_csv_export (CVSS 7.7)
- CVE-2026-110070 — Modern Events Calendar Lite < 7.36.4 - Subscriber+ Arbitrary Post Modification via IDOR (CVSS 6.5)
- CVE-2026-110069 — Modern Events Calendar Lite < 7.37.0 - Subscriber+ Sensitive Data Disclosure via mec_event_bookings and mec_attendees AJAX Actions (CVSS 4.3)
- CVE-2026-105067 — WordPress Modern Events Calendar Lite plugin < 7.37.0 - SQL Injection vulnerability (CVSS 8.5)
- CVE-2026-11349 — Modern Events Calendar (Lite & Pro) < 7.34.0 - Unauthenticated SQL Injection via mec_list_load_more (CVSS 8.6)
- CVE-2021-4458 — Modern Events Calendar Lite <= 6.3.0 - Unauthenticated SQL Injection (CVSS 9.8)
- CVE-2025-5733 — Modern Events Calendar <= 7.21.9 - Information Exposure (CVSS 5.3)
- CVE-2024-6522 — Modern Events Calendar <= 7.12.1 - Authenticated (Subscriber+) Server Side Request Forgery (CVSS 9.6)
- CVE-2024-5441 — Modern Events Calendar <= 7.11.0 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8)
- CVE-2023-4021 — Modern Events Calendar lite < 7.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.8)
- CVE-2023-1400 — Modern Events Calendar lite < 6.5.2 - Admin+ Stored XSS (CVSS 4.8)
- CVE-2022-30533 — (CVSS 5.4)
- CVE-2022-27848 — WordPress Modern Events Calendar Lite plugin <= 6.5.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.8)
- CVE-2022-0364 — Modern Events Calendar Lite < 6.4.0 - Contributor+ Stored Cross Site Scripting (CVSS 5.4)
- CVE-2021-25046 — Modern Events Calendar Lite < 6.2.0 - Subscriber+ Category Add Leading to Stored XSS (CVSS 5.4)
- CVE-2021-24946 — Modern Events Calendar < 6.1.5 - Unauthenticated Blind SQL Injection (CVSS 9.8)
- CVE-2021-24925 — Modern Events Calendar Lite < 6.1.5 - Reflected Cross-Site Scripting (CVSS 6.1)
- CVE-2021-24716 — Modern Events Calendar Lite < 5.22.3 - Authenticated Stored Cross Site Scripting (CVSS 5.4)
- CVE-2021-24687 — Modern Events Calendar Lite < 5.22.2 - Admin+ Stored Cross-Site Scripting (CVSS 4.8)
- CVE-2021-24149 — Modern Events Calendar Lite < 5.16.6 - Authenticated SQL Injection (CVSS 8.8)
- CVE-2021-24147 — Modern Events Calendar Lite < 5.16.5 - Authenticated Stored Cross-Site Scripting (XSS) (CVSS 5.4)
- CVE-2021-24146 — Modern Events Calendar Lite < 5.16.5 - Unauthenticated Events Export (CVSS 7.5)
- CVE-2021-24145 — Modern Events Calendar Lite < 5.16.5 - Authenticated Arbitrary File Upload leading to RCE (CVSS 7.2)
- CVE-2020-9459 — (CVSS 5.4)