CVE-2026-96534

HighCVSS 7.7

Published: 18/10/2026(UTC)Updated: 18/10/2026(UTC)Translated: 18/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

5th percentile - higher than 5% of all known CVEs

Summary

The Modern Events Calendar Lite and Modern Event Calendar Pro WordPress plugins before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement. This allows authenticated users with minimal privileges (Subscriber and above) to perform SQL injection attacks.

Risk Assessment

An attacker with a low-privileged account can execute arbitrary SQL queries, risking data leakage, modification or deletion in the WordPress database. This may lead to full site compromise.

Recommendation

Update the Modern Events Calendar Lite and Modern Event Calendar Pro plugins to version 7.37.0 or later. Check database integrity for unauthorized changes.

Other vulnerabilities in Modern Events Calendar

CVE-2026-73339Critical
An unauthenticated attacker can exploit SQL Injection in Modern Events Calendar versions prior to 7.35.0.

Original NVD description (English source)

The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing authenticated users with minimal privileges (Subscriber and above) to perform SQL injection attacks.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS