CVE-2021-24149

PoC —

CVSS 3.1

8.8 high

EPSS

2%p73

Published

Mar 18, 2021 (Mar 18, 2021)

Modified

Jun 17, 2026

Description

Unvalidated input in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.6, did not sanitise the mec[post_id] POST parameter in the mec_fes_form AJAX action when logged in as an author+, leading to an authenticated SQL Injection issue.

Vendors: webnus
Products: modern events calendar lite
Ecosystems: WordPress
Weakness: CWE-89
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.5%)

In the news0 stories

No ingested article mentions this CVE yet.