Modern Events Calendar Lite < 5.22.3 - Authenticated Stored Cross Site Scripting

Vulnerability

The Modern Events Calendar Lite WordPress plugin before version 5.22.3 does not properly sanitize or escape values set by users with access to adjust settings within the wp-admin dashboard [1]. This allows malicious input to be stored unsanitized in the plugin's configuration, leading to a stored cross-site scripting (XSS) vulnerability [1]. The weakness affects all versions prior to 5.22.3 [1].

Exploitation

An attacker must have authenticated access to the WordPress admin area with sufficient privileges to modify the plugin's settings (e.g., Administrator role) [1]. The attacker then crafts a malicious payload and inserts it into one of the affected settings fields. The payload is stored by the plugin and later executed in the browser of any administrator who views the settings page or other vulnerable output contexts [1]. No additional user interaction beyond viewing the page is required for the XSS to trigger.

Impact

Successful exploitation results in stored cross-site scripting, enabling the attacker to execute arbitrary JavaScript in the context of the WordPress admin panel [1]. Depending on the attacker's objective, this can lead to session hijacking, forced administrative actions, defacement, or theft of sensitive data visible to the admin session. The CVSS score is 3.8 (low) due to the high privileges required [1].

Mitigation

The vulnerability is fixed in version 5.22.3 of the Modern Events Calendar Lite plugin [1]. Users should update immediately to that version or later. For sites that cannot update, restricting access to the plugin settings to only fully trusted administrators is a partial workaround, but updating is the only complete fix.