CVE-2020-9459

MEDIUM 5.4CVE-2020-9459 · Published 28/02/2020 · updated 17/06/2026

In short

CVE-2020-9459 is a MEDIUM (CVSS 5.4) vulnerability affecting modern events calendar lite (webnus).
Chance of exploitation in the next 30 days (EPSS): 1.0%, higher than 63.5% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
modern events calendar lite webnus	`≤ 5.1.6`	No fix yet

Description

Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite plugin through 5.1.6 for WordPress allows remote authenticated users (with minimal permissions) to inject arbitrary JavaScript, HTML, or CSS via Ajax actions. This affects mec_save_notifications and import_settings.

References

wpvulndb.com/vulnerabilities/10100 · Exploit
wordfence.com/blog/2020/02/site-takeover-campaign-exploits-multiple-zero-day-vulnerabilities · Exploit

More vulnerabilities in modern events calendar lite

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

modern events calendar lite

webnus

≤ 5.1.6

No fix yet

Description

More vulnerabilities in modern events calendar lite

See all →