Modern Events Calendar Lite and Pro: SQL injection
Modern Events Calendar Lite and Modern Event Calendar Pro versions before 7.37.0 allow a Subscriber or higher-privileged authenticated user to inject SQL through a parameter that reaches a database statement without adequate sanitization and escaping. The export does not identify the parameter, endpoint, action, function, specific query, or reachable records; a broader database-compromise claim is not established by this description. The completed export identifies 7.37.0 as fixed for both products.
- Component
- Multiple WordPress plugins
- Plugin slug
modern-events-calendar-lite- Affected
- Lite: < 7.37.0, Pro: < 7.37.0
- Safe version
7.37.0- Published
- Oct 18, 2026
This CVE was published Oct 18, 2026 and is one of 21 known issues for this plugin.
Update, patch or deactivate.
Update Modern Events Calendar Lite and Pro to 7.37.0 or a later supported release. The completed authoritative export identifies this fixed boundary. Update whichever edition is installed; both Lite and Pro are affected before 7.37.0 and fixed at 7.37.0. Parameterize attacker-controlled SQL values rather than interpolating them into a query; the export does not identify the vulnerable parameter or SQL operation.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing authenticated users with minimal privileges (Subscriber and above) to perform SQL injection attacks.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N