CVE-2026-96534 PUBLISHED

Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_fes_csv_export

Assigner: WPScan
Reserved: 23.09.2026 Published: 18.10.2026 Updated: 18.10.2026

The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing authenticated users with minimal privileges (Subscriber and above) to perform SQL injection attacks.

Product Status

Vendor Unknown
Product Modern Events Calendar Lite
Versions Default: unaffected
  • affected from 0 to 7.37.0 (excl.)
Vendor Unknown
Product Modern Event Calendar Pro
Versions Default: unaffected
  • affected from 0 to 7.37.0 (excl.)

Credits

  • Sanjar Tulkinov finder
  • WPScan coordinator

References

Problem Types

  • CWE-89 SQL Injection CWE