CVE-2026-102499

7.7 Élevée

Publiée le 21/10/2026 à 08:16 · Modifiée le 21/10/2026 à 20:37 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL queries into already existing queries and extract sensitive data from the database.

Traduire en français

Produits concernés

Unknown Modern Events Calendar Lite
Unknown Modern Event Calendar Pro

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.7 Élevée	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N`

Faiblesses (CWE)

CWE-89

Références

https://wpscan.com/vulnerability/adf388fb-21c9-4310-95b3-b9065ca51480/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories