Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.5

Modern Events Calendar Lite plugin can let attackers read data

CVE-2026-105067 · published 21 days ago
Summary

The Modern Events Calendar Lite plugin for WordPress can be tricked into running hidden database commands, allowing a remote attacker to view information stored in your site’s database. This could expose visitor details or other sensitive content. Update the plugin to version 7.37.0 or later as soon as possible to close the gap.

What to do
  • Update webnus modern events calendar lite to version 7.37.0.
Affected software
VendorProductAffected versions
webnus modern events calendar lite < 7.37.0
Fix: upgrade to 7.37.0
Original advisory text
WordPress Modern Events Calendar Lite plugin < 7.37.0 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Webnus Modern Events Calendar Lite modern-events-calendar-lite allows Blind SQL Injection.This issue affects Modern Events Calendar Lite: from n/a before 7.37.0.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
8.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published14 Oct 2026
Updated4 Nov 2026
First seen14 Oct 2026
Sources
CVE-2026-105067 · NVD
CVE-2026-105067 · MITRE
Track software like this
Free during beta