WordPress Modern Events Calendar Lite plugin <= 6.5.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Vulnerability

The Modern Events Calendar Lite WordPress plugin versions up to and including 6.5.1 contain a stored cross-site scripting (XSS) vulnerability. An authenticated user with administrator-level privileges (or higher) can inject arbitrary JavaScript into the plugin's settings or event data, which is then stored and executed when other users or visitors view the affected pages. [1]

Exploitation

An attacker must have an admin+ account on the WordPress site. They can then craft a malicious payload (e.g., JavaScript) and inject it into a vulnerable input field within the plugin's admin interface. No additional user interaction is required for the stored XSS to execute when the page is loaded by other users. [1]

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser. This can lead to session hijacking, defacement, redirection to malicious sites, or theft of sensitive information. The attack can affect any user who visits the compromised page, including site visitors. [1]

Mitigation

The vendor released version 6.5.2 to fix the vulnerability. However, as of May 11, 2022, the plugin has been permanently closed and removed from the WordPress.org plugin directory due to a guideline violation [2]. Users who have the plugin installed should immediately uninstall it and consider alternative event calendar plugins. If version 6.5.2 is available from other sources, updating to that version will resolve the XSS issue. [1][2]