CVE-2026-102499

Published 21 October 2026 · tracked since 22 October 2026

Description

The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL queries

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-56386 HIGH 7.5
• CVE-2026-114242 HIGH 7.3
• CVE-2026-110369 HIGH 8.8
• CVE-2026-110370 HIGH 8.8
• CVE-2026-85683 HIGH 8.8
• CVE-2026-50106 MEDIUM 6.5
• CVE-2026-85642 HIGH 7.5
• CVE-2026-87838 MEDIUM 6.5
• CVE-2026-88784 HIGH 7.5
• CVE-2026-92997 HIGH 8.6

→ Open the live CVE board · all tools