Live › vulnerability › CVE-2026-96534
Go to dashboardThe Modern Events Calendar Lite and Pro WordPress plugins build a SQL statement from an unsanitised, unescaped parameter. An authenticated user with the lowest role (Subscriber) can inject SQL to read or change the site database.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Lite or Pro version of the plugin before 7.37.0 are exposed, and the risk is highest where anyone can register or hold a Subscriber account. Sites with no open registration and no untrusted accounts have a much smaller exposure, but the plugin should still be updated. The sources do not say which specific feature or endpoint carries the flawed parameter.
No product ranges from the sources yet.
wp-content/plugins/modern-events-calendar-lite/ and wp-content/plugins/modern-event-calendar-pro/Version: line and compare it with the fixed version7.37.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing authenticated users with minimal privileges (Subscriber and above) to perform SQL injection attacks.
This page as .md · .json · in your agent: get_signal("CVE-2026-96534")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.