CVE-2026-96534
Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_fes_csv_export
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing authenticated users with minimal privileges (Subscriber and above) to perform SQL injection attacks.
| Vendor | unknown |
| Product | modern events calendar lite |
| Published | Oct 18, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown modern events calendar lite
Be the first to know when new unknown vulnerabilities affecting unknown modern events calendar lite are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Modern Events Calendar Lite
0 < 7.37.0
Unknown / Modern Event Calendar Pro
0 < 7.37.0
References
Credits
Sanjar Tulkinov WPScan