Modern Events Calendar Lite < 6.1.5 - Reflected Cross-Site Scripting

The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the current_month_divider parameter of its mec_list_load_more AJAX call (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue

N/A

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

WordPress 插件跨站脚本漏洞

WordPress是Wordpress基金会的一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress 插件是WordPress开源的一个应用插件。 WordPress Plugins Modern Events Calendar Lite 存在跨站脚本漏洞，该漏洞源于在6.1.5之前的Modern Events Calendar Lite WordPress插件在输出回响应之前，没有对其mec列表的当前月份分隔符参数进行处理和逃逸，加载更多的AJAX

N/A

N/A