PT-2025-29321 · WordPress · Modern Events Calendar Lite

Published 2025-07-12 · Updated 2025-07-29 · CVE-2021-4458

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Modern Events Calendar Lite plugin for WordPress versions prior to 6.4.0

Description: The Modern Events Calendar Lite plugin for WordPress is susceptible to SQL Injection via the id parameter of the /wp ajax mec load single page API endpoint. Insufficient escaping of user-supplied input and inadequate SQL query preparation can allow unauthenticated attackers to inject additional SQL queries, potentially extracting sensitive information from the database. This issue is exploitable on sites where addslashes is disabled.

Recommendations: Update to version 6.4.0 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-4458

Affected Products

Modern Events Calendar Lite

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2021-4458 · Security Note
• https://osv.dev/vulnerability/CVE-2021-4458 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset/2683727/modern-events-calendar-lite/trunk/app/libraries/render.php · Patch
• https://t.me/cvenotify/128698 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/703ba736-5834-40f2-9cf6-a6a70a73e4d6?source=cve · Note
• https://twitter.com/VolerionSec/status/1944009060644233573 · Twitter Post
• https://twitter.com/CVEnew/status/1944010809538916361 · Twitter Post
• https://t.me/cveNotify/130204 · Telegram Post
• https://t.me/cvetracker/27638 · Telegram Post