Stored Cross-Site Scripting Vulnerability in Webnus Modern Events Calendar Lite Plugin

CVE-2020-9459

Summary

The Webnus Modern Events Calendar Lite plugin for WordPress has multiple vulnerabilities that allow remote authenticated users with minimal permissions to execute arbitrary scripts within the application. These vulnerabilities primarily involve Ajax actions that enable the injection of JavaScript, HTML, or CSS through specific functionalities like mec_save_notifications and import_settings. Exploitation of these vulnerabilities could lead to unauthorized actions, potentially compromising the integrity and security of the affected sites.

References