WordPress plugin · modern-events-calendar-lite
Is Modern Events Calendar Lite safe?
Closed. Replace it.
wordpress.org closed it on May 11, 2022 (guideline violation), so it gets no more security fixes, and 20 flaws are on record. If your site runs it, move to a maintained alternative.
- Flaws on record
- 20
- High or critical
- 7
- Exploited
- none
Every recorded flaw
- Oct 18, 2026Modern Events Calendar Lite: Does not verify that a user is authorized to edit the target post before updating itCVE-2026-110070 · fixed in 7.36.4 · reported by WPScanMedium 6.5
- Oct 18, 2026Modern Events Calendar Lite: Does not perform capabilityCVE-2026-110069 · fixed in 7.37.0 · reported by WPScanMedium 4.3
- Oct 14, 2026Modern Events Calendar Lite: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-105067 · fixed in 7.37.0 · reported by PatchstackHigh 8.5
- Jul 12, 2025Modern Events Calendar Lite: SQL InjectionCVE-2021-4458 · affects up to 6.3.0 · reported by WordfenceMedium 5.9
- Jun 6, 2025Modern Events Calendar Lite: Full Path DisclosureCVE-2025-5733 · affects up to 7.21.9 · reported by WordfenceMedium 5.3
- Aug 7, 2024Modern Events Calendar: Server-Side Request ForgeryCVE-2024-6522 · affects up to 7.12.1 · reported by WordfenceHigh 8.5
- Jul 9, 2024Modern Events Calendar: Arbitrary file uploadsCVE-2024-5441 · affects up to 7.11.0 · reported by Wordfence1.1% oddsHigh 8.8
- Oct 20, 2023Modern Events Calendar lite: Stored Cross-Site ScriptingCVE-2023-4021 · fixed in 7.1.0 · reported by WordfenceMedium 4.4
- Mar 27, 2023Modern Events Calendar Lite: Does not sanitise and escape some of its settingsCVE-2023-1400 · fixed in 6.5.2 · reported by WPScanMedium 4.8
- Apr 14, 2022Authenticated (admin+ user) Stored Cross-Site Scripting (XSS) in Modern Events Calendar Lite (WordPress plugin) <= 6.5.1CVE-2022-27848 · affects up to 6.5.1 · reported by PatchstackLow 3.4
- Mar 21, 2022Modern Events Calendar Lite: Does not sanitize and escape some of the Hourly Schedule parametersCVE-2022-0364 · fixed in 6.4.0 · reported by WPScan70% oddsMedium 5.4
- Jan 17, 2022Modern Events Calendar Lite: Alloed any logged-in userCVE-2021-25046 · fixed in 6.2.0 · reported by WPScanMedium 5.4
- Dec 13, 2021Modern Events Calendar Lite: Does not sanitise and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX actionCVE-2021-24946 · fixed in 6.1.5 · reported by WPScan73% oddsCritical 9.8
- Dec 13, 2021Modern Events Calendar Lite: Does not sanitise and escape the current_month_divider parameter of its mec_list_load_more AJAX call (available to both unauthenticated and authenticated users) before outputting it back in tCVE-2021-24925 · fixed in 6.1.5 · reported by WPScanMedium 6.1
- Nov 1, 2021Modern Events Calendar Lite: Does not properly sanitize or escape values set by users with access to adjust settings withing wp-adminCVE-2021-24716 · fixed in 5.22.3 · reported by WPScanMedium 5.4
- Oct 4, 2021Modern Events Calendar Lite: Does not escape some of its settings before outputting them in attributesCVE-2021-24687 · fixed in 5.22.2 · reported by WPScanMedium 4.8
- Mar 18, 2021Unvalidated input in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.6, did not sanitise the mec[post_id] POST parameter in the mec_fes_fCVE-2021-24149 · fixed in 5.16.6 · reported by WPScan1.5% oddsHigh 8.8
- Mar 18, 2021Unvalidated input and lack of output encoding in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not sanitise the mic_comment fielCVE-2021-24147 · fixed in 5.16.5 · reported by WPScanMedium 5.4
- Mar 18, 2021Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export files, CVE-2021-24146 · fixed in 5.16.5 · reported by WPScan31% oddsHigh 7.5
- Mar 18, 2021Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones tCVE-2021-24145 · fixed in 5.16.5 · reported by WPScan87% oddsHigh 7.2
Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Get in touch
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
Not ready to talk yet? Run the free website check and see what Google sees.