CVE-2021-24687

4.8 mediumEPSS 0.6%

Medium (4.8) in webnus modern events calendar lite. EPSS 0.6% chance of exploitation in the next 30 days.

The Modern Events Calendar Lite WordPress plugin before 5.22.2 does not escape some of its settings before outputting them in attributes, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Severity

CVSS 3.1

4.8 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 49% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2021-10-04
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

webnus:modern_events_calendar_lite

References

https://wpscan.com/vulnerability/300ba418-63ed-4c03-9031-263742ed522e
https://wpscan.com/vulnerability/300ba418-63ed-4c03-9031-263742ed522e

Check your stack JSON