PT-2022-18637 · WordPress · Modern Events Calendar Lite

Muhammad Daffa · Published 2022-04-14 · Updated 2022-04-22 · CVE-2022-27848

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Modern Events Calendar Lite (WordPress plugin) versions <= 6.5.1

Description The issue is related to an Authenticated Stored Cross-Site Scripting (XSS) in the Modern Events Calendar Lite WordPress plugin. This allows an attacker with admin or higher privileges to store malicious scripts that can be executed when other users access the affected system.

Recommendations For Modern Events Calendar Lite (WordPress plugin) versions <= 6.5.1, update to a version greater than 6.5.1 to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-27848

Affected Products

Modern Events Calendar Lite

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-27848 · Security Note
• https://osv.dev/vulnerability/CVE-2022-27848 · Vendor Advisory
• https://wordpress.org/plugins/modern-events-calendar-lite/#developers · Note
• https://t.me/cibsecurity/40831 · Telegram Post
• https://patchstack.com/database/vulnerability/modern-events-calendar-lite/wordpress-modern-events-calendar-lite-plugin-6-5-1-authenticated-stored-cross-site-scripting-xss-vulnerability · Note