CVE-2020-9459

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2020-9459

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-9459.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2020-9459

Published

2020-02-28T21:15:13.367Z

Modified

2026-04-02T06:16:34.575400Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

[none]

Details

Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite plugin through 5.1.6 for WordPress allows remote authenticated users (with minimal permissions) to inject arbitrary JavaScript, HTML, or CSS via Ajax actions. This affects mecsavenotifications and import_settings.

References

Affected packages

Git / github.com/webnuswp/modern-events-calendar-lite

Affected ranges

Type

GIT

Repo

https://github.com/webnuswp/modern-events-calendar-lite

Events

Introduced

Last affected

bbe2ce87fb7018f9b397a7978909f50cbdeb6a8b

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "5.1.6"
        }
    ]
}

Affected versions

4.*

4.7.7

4.8.1

4.8.2

4.8.3

4.8.5

5.*

5.0.0

5.0.1

5.0.2

5.0.5

5.1.0

5.1.5

5.1.6

v4.*

v4.7.6

v4.9.0

v4.9.5

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-9459.json"