blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2020-9459

MEDIUM 5.4 CVSS 3.1
Published
February 28, 2020
Last modified
June 17, 2026
NVD status
Modified
Reported by
cve@mitre.org
Weakness
CWE-79
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Description

Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite plugin through 5.1.6 for WordPress allows remote authenticated users (with minimal permissions) to inject arbitrary JavaScript, HTML, or CSS via Ajax actions. This affects mec_save_notifications and import_settings.

Affected products and versions

  • n/a n/a — Versions not specified
  • webnus modern_events_calendar_lite — Up to and including 5.1.6

References

  • wpvulndb.com https://wpvulndb.com/vulnerabilities/10100 Exploit, Third Party Advisory
  • www.wordfence.com https://www.wordfence.com/blog/2020/02/site-takeover-campaign-exploits-multiple-zero-day-vulnerabilities/ Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record