Stored Cross-Site Scripting Vulnerability in Modern Events Calendar Lite for WordPress
CVE-2023-4021
4.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 20 October 2023
What is CVE-2023-4021?
The Modern Events Calendar Lite plugin for WordPress allows for Stored Cross-Site Scripting due to inadequate input sanitization and output escaping. Authenticated attackers with administrator-level permissions can exploit this vulnerability by injecting malicious web scripts via the Google API key and Calendar ID. This risk is particularly pronounced in multi-site installations and setups where the unfiltered_html option is disabled, leading to potential execution of harmful scripts when users access compromised pages.
Affected Version(s)
Modern Events Calendar Lite * < 7.1.0