CVE-2021-24147— Modern Events Calendar Lite < 5.16.5 - Authenticated Stored Cross-Site Scripting (XSS)
Quick assessment
Affected
Unknown Modern Events Calendar Lite
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Wordpress Modern Events Calendar Lite是 （Wordpress）开源的一个应用插件。该插件用于管理事件网站的最佳工具。 WordPress Modern Events Calendar Lite plugin before 5.16.5 存在跨站脚本漏洞，该漏洞允许用户与权限低至作者与跨站点脚本添加事件有效负载。
Possible ATT&CK Techniques 1 AI
T1059.007 · JavaScript
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-24147
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Modern Events Calendar Lite < 5.16.5 - Authenticated Stored Cross-Site Scripting (XSS)
Source: CVE Program / CVE List V5
Vulnerability Description
Unvalidated input and lack of output encoding in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not sanitise the mic_comment field (Notes on time) when adding/editing an event, allowing users with privilege as low as author to add events with a Cross-Site Scripting payload in them, which will be triggered in the frontend when viewing the event.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
Wordpress Modern Events Calendar Lite 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Wordpress Modern Events Calendar Lite是 （Wordpress）开源的一个应用插件。该插件用于管理事件网站的最佳工具。 WordPress Modern Events Calendar Lite plugin before 5.16.5 存在跨站脚本漏洞，该漏洞允许用户与权限低至作者与跨站点脚本添加事件有效负载。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Modern Events Calendar Lite | 5.16.5 ~ 5.16.5 | - |
|
II. Public POCs for CVE-2021-24147
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-24147
请登录查看更多情报信息。
Vendor Advisories for CVE-2021-24147 (1)
Same Patch Batch · Unknown · 2021-03-18 · 27 CVEs total
| CVE-2021-24136 | Testimonials Widget < 4.0.0 - Multiple Authenticated Stored XSS | |
| CVE-2021-24149 | Modern Events Calendar Lite < 5.16.6 - Authenticated SQL Injection | |
| CVE-2021-24148 | MStore API < 3.2.0 - Authentication Bypass With Sign In With Apple | |
| CVE-2021-24146 | Modern Events Calendar Lite < 5.16.5 - Unauthenticated Events Export | |
| CVE-2021-24145 | Modern Events Calendar Lite < 5.16.5 - Authenticated Arbitrary File Upload leading to RCE | |
| CVE-2021-24144 | Contact Form 7 Database Addon < 1.2.5.6 - CSV Injection | |
| CVE-2021-24143 | AccessPress Social Icons < 1.8.1 - Authenticated SQL Injection | |
| CVE-2021-24142 | 301 Redirects - Easy Redirect Manager < 2.51 - Authenticated SQL Injection | |
| CVE-2021-24141 | Advanced Database Cleaner < 3.0.2 - Authenticated SQL injection | |
| CVE-2021-24140 | Ajax Load More < 5.3.2 - Authenticated SQL Injection | |
| CVE-2021-24139 | Photo Gallery by 10Web < 1.5.55 - Unauthenticated SQL Injection | |
| CVE-2021-24138 | AdRotate < 5.8.4 - Authenticated SQL Injection | |
| CVE-2021-24137 | Blog2Social: Social Media Auto Post & Scheduler < 6.3.1 - Authenticated SQL Injection | |
| CVE-2021-24123 | PowerPress < 8.3.8 - Authenticated Arbitrary File Upload leading to RCE | |
| CVE-2021-24135 | WP Customer Reviews < 3.4.3 - Multiple Unauthenticated and Low Priv Authenticated Stored X | |
| CVE-2021-24134 | Constant Contact Forms < 1.8.8 - Multiple Authenticated Stored XSS | |
| CVE-2021-24133 | ActiveCampaign < 8.0.2 - Cross-Site Request Forgery in Settings | |
| CVE-2021-24132 | Slider by 10Web < 1.2.36 - Multiple Authenticated SQL Injection | |
| CVE-2021-24131 | Anti-Spam by CleanTalk < 5.149 - Multiple Authenticated SQL Injections | |
| CVE-2021-24130 | WP Google Map Plugin < 4.1.5 - Authenticated SQL Injection |
Showing top 20 of 27 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Modern Events Calendar Lite
-
CVE-2021-4458
Modern Events Calendar Lite <= 6.3.0 - Unauthenticated SQL I -
CVE-2025-5733
Modern Events Calendar <= 7.21.9 - Information Exposure -
CVE-2023-4021
Modern Events Calendar lite < 7.1.0 - Authenticated (Admin+) -
CVE-2023-1400
Modern Events Calendar lite < 6.5.2 - Admin+ Stored XSS -
CVE-2022-30533
Modern Events Calendar Lite 跨站脚本漏洞
Same vendor: Unknown
-
CVE-2026-19856
All in One SEO < 5.0.2.1 - Unauthenticated Arbitrary Shortco -
CVE-2026-92924
Unlimited Elements For Elementor < 2.0.21 - Subscriber+ Arbi -
CVE-2026-97219
MStore API 4.21.1 - 4.22.0 - Subscriber+ Payment Bypass via -
CVE-2026-91020
WebToffee Gift Cards for WooCommerce < 1.3.1 - Unauthenticat -
CVE-2026-90987
Easy PayPal & Stripe Buy Now Button 1.8 - 2.0.5 - Unauthenti
Same weakness: CWE-79
-
CVE-2026-103888
WPC Smart Quick View for WooCommerce <= 4.4.0 - Reflected Cr -
CVE-2026-103909
Calculated Fields Form <= 5.5.1.5 - Reflected DOM-Based Cros -
CVE-2026-100148
Rich Showcase for Google Reviews <= 7.1.3 - Authenticated (S -
CVE-2026-96575
Transliterator <= 2.5.8 - Unauthenticated Stored Cross-Site -
CVE-2026-87091
Welcart e-Commerce <= 2.12.2 - Unauthenticated Stored Cross-
V. Comments for CVE-2021-24147
No comments yet