CVE-2026-102499
Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_attendees AJAX Action
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL queries into already existing queries and extract sensitive data from the database.
| Vendor | unknown |
| Product | modern events calendar lite |
| Published | Oct 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown modern events calendar lite
Be the first to know when new unknown vulnerabilities affecting unknown modern events calendar lite are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Modern Events Calendar Lite
0 < 7.37.0
Unknown / Modern Event Calendar Pro
0 < 7.37.0
References
Credits
Wes Ring WPScan