Modern Events Calendar vulnerabilities

2 known vulnerabilities in Modern Events Calendar from Webnus. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.6 Critical severity

  Modern Events Calendar: Server-Side Request Forgery

  CVE-2024-6522Aug 7, 2024Webnus

  The Modern Events Calendar plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.12.1 via the 'mec_fes_form' AJAX function. This makes it possible for authenticated attackers, with Subscriber-level access and

• 8.8 High severity

  Modern Events Calendar: Unrestricted Upload of File with Dangerous Type

  CVE-2024-5441Jul 9, 2024WebnusEPSS 1.12%

  The Modern Events Calendar plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_featured_image function in all versions up to, and including, 7.11.0. This makes it possible for authenticated attackers, wit