CVE-2026-96534
CVE-2026-96534 · Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_fes_csv_export
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing authenticated users with minimal privileges (Subscriber and above) to perform SQL injection attacks.
CVSS 7.7 · High · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
modern events calendar lite
- Versions
- ≥ 0, < 7.37.0: Affected (semver)
Update to 7.37.0
modern event calendar pro
- Versions
- ≥ 0, < 7.37.0: Affected (semver)
Update to 7.37.0