{"id":"CVE-2026-96534","title":"Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_fes_csv_export","summary":"The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing authenticated users with minim…","severity":"none","cwe":["CWE-89"],"product":"Modern Events Calendar Lite","affected":["modern_events_calendar_lite < 7.37.0","modern_event_calendar_pro < 7.37.0"],"published":"2026-10-18","updated":"2026-10-18","sourceUpdated":"2026-10-18T06:00:17.293Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-96534","references":[{"url":"https://wpscan.com/vulnerability/8c2f8229-1222-49e7-a17f-ef0852f4c805/"}],"tags":["cve.org"],"ingestedAt":"2026-10-18T06:38:27.433Z","slug":"CVE-2026-96534","body":"## Overview\n\nThe Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing authenticated users with minimal privileges (Subscriber and above) to perform SQL injection attacks.\n\n## Affected\n\n- `modern_events_calendar_lite < 7.37.0`\n- `modern_event_calendar_pro < 7.37.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}