CVE-2026-105067
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
An SQL Injection vulnerability in Webnus Modern Events Calendar Lite allows blind SQL injection. Affects versions before 7.37.0.
Risk Assessment
An attacker can exploit the vulnerability to manipulate the database, potentially leading to data leakage, modification, or corruption.
Recommendation
Update Modern Events Calendar Lite to version 7.37.0 or later and implement input validation.
Other vulnerabilities in Modern Events Calendar Lite
See all- CVE-2026-110070Medium
The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it. This allows authenticated users with the Subscriber role to modify the title, content, and excerpt of arbitrary posts, pages, and custom post types created by other users.
- CVE-2026-110069Medium
The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks before returning event booking and attendee data. This allows any authenticated user, including Subscribers, to disclose the names, email addresses, transaction IDs and payment amounts of every booking on the site.
Original NVD description (English source)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Webnus Modern Events Calendar Lite modern-events-calendar-lite allows Blind SQL Injection.This issue affects Modern Events Calendar Lite: from n/a before 7.37.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS