CVE-2022-0364

What it actually does

The flaw is a stored cross-site scripting vulnerability in the Modern Events Calendar Lite WordPress plugin before version 6.4.0. Some Hourly Schedule parameters are not properly sanitized on input or escaped on output, allowing an authenticated user with privileges as low as Contributor to save JavaScript or HTML payloads that later execute in another user's browser when the affected event content is viewed. Because the script runs in the victim's browser session, it can read page-accessible data, steal WordPress nonces, perform same-origin actions as the victim, alter displayed content, redirect users, or support account takeover workflows if an administrator views the malicious content.

Why it matters to the business

A low-privileged website account can be used to plant malicious code inside event content, creating risk of administrator account compromise, unauthorized site changes, visitor phishing, reputational damage, and possible malware delivery through the affected WordPress site. The vulnerability is not listed in CISA KEV and is not known from the provided data to be used in ransomware campaigns, but the EPSS score is high and exploit code is available, so internet-facing WordPress sites using the plugin should treat remediation as urgent. The supplied package-based fixed-version list appears inconsistent with the described WordPress plugin vulnerability; organizations should prioritize validating and updating the Modern Events Calendar Lite plugin rather than relying only on unrelated operating-system package status.

How an attack unfolds

An attacker first obtains or registers a WordPress account with at least Contributor-level permissions on a site using a vulnerable version of Modern Events Calendar Lite. The attacker creates or edits event content and inserts a crafted JavaScript payload into one of the affected Hourly Schedule fields. Because the plugin version does not correctly sanitize and escape those fields, the payload is stored by the application. When an administrator, editor, reviewer, or site visitor later views the affected event or related administrative preview page, the browser executes the attacker's script in the context of the WordPress site. The script can then harvest page-accessible security tokens, issue authenticated requests as the victim, modify content, create persistence where the victim has sufficient privileges, redirect users to phishing pages, or load additional browser-side payloads.

How to fix it

Upgrade Modern Events Calendar Lite to version 6.4.0 or later, then review and remove any suspicious Hourly Schedule content from existing events. If updates cannot be applied immediately, restrict event creation and editing to trusted users only, disable public or low-privilege content submission, remove Contributor access where not required, and consider temporarily disabling the plugin on high-risk sites. Add compensating controls such as a web application firewall rule to block common script payloads in event schedule fields, but do not treat filtering as a substitute for upgrading. After patching, invalidate active WordPress sessions for users with content-management or administrator privileges and rotate credentials for any accounts suspected of exposure. The provided OS package fixed versions are inconsistent with the plugin description; for this vulnerability, the primary corrective action is updating the WordPress plugin to 6.4.0 or newer and verifying advisory mapping in vulnerability management tooling.

How to confirm the fix worked

Confirm the installed Modern Events Calendar Lite plugin version is 6.4.0 or later from the WordPress admin plugin page, WP-CLI, or filesystem metadata under the plugin directory. Using WP-CLI, review installed plugins with `wp plugin list` and confirm the Modern Events Calendar Lite entry reports a fixed version. Validate that low-privileged users cannot store executable HTML or JavaScript in Hourly Schedule fields by testing in a staging environment with benign payloads such as an encoded script marker and confirming the output is escaped rather than executed. Review existing events for suspicious schedule entries containing script tags, event-handler attributes, JavaScript URLs, iframes, encoded HTML entities, or obfuscated payloads. Re-run vulnerability scans after updating and ensure scanners correctly identify the WordPress plugin version rather than unrelated Linux kernel package versions.

Typical attack path

1. Identify a WordPress site running Modern Events Calendar Lite before version 6.4.0.
2. Obtain a low-privileged account, such as Contributor, through registration, credential stuffing, phishing, or prior compromise.
3. Create or edit event content that includes Hourly Schedule data.
4. Insert a stored XSS payload into a vulnerable Hourly Schedule parameter.
5. Wait for a privileged user or visitor to view the affected event, preview, or administrative page.
6. Execute JavaScript in the victim's browser under the vulnerable site's origin.
7. Use the victim session to steal nonces, perform unauthorized WordPress actions, change content, inject additional scripts, or redirect users.

How to detect it

Look for evidence that low-privileged WordPress users created or modified event content containing executable markup, especially shortly before an administrator viewed or previewed the same content. Useful sources include web server access logs, WordPress audit logs, plugin activity logs, database backups or content exports, WAF logs, reverse proxy logs, and endpoint telemetry from the web server. Review POST requests to WordPress admin endpoints associated with event creation or updates, especially `wp-admin/post.php`, `wp-admin/admin-ajax.php`, and REST API endpoints, where request bodies include Hourly Schedule fields and script-like content. In WordPress data, inspect event posts and associated metadata for `<script>`, HTML event handlers such as `onerror` or `onload`, `javascript:` URLs, iframes, encoded HTML entities, base64-like strings, or external script references. Correlate suspicious content changes with subsequent administrator visits, unexpected admin actions, new users, plugin/theme modifications, option changes, injected content, redirects, or unfamiliar external domains loaded by browsers. If exploitation is suspected, preserve logs and database snapshots before cleanup, identify the author account used to plant the payload, and review whether the payload performed follow-on actions using victim privileges.

• wp-content/plugins/modern-events-calendar-lite/
• modern-events-calendar-lite
• wp-admin/post.php
• wp-admin/admin-ajax.php
• mec_hourly
• hourly_schedule
• hourly_schedules
• <script
• </script>
• javascript:
• onerror=
• onload=
• onclick=
• onmouseover=
• document.cookie
• document.location
• window.location
• eval(
• atob(
• <iframe
• <svg
• <img src=x

What your security team should do

• Immediately inventory WordPress sites for Modern Events Calendar Lite and identify installations below version 6.4.0.
• Patch vulnerable installations to Modern Events Calendar Lite 6.4.0 or later, prioritizing internet-facing sites and sites with multiple content contributors.
• Review all event Hourly Schedule fields and recently modified event content for stored script payloads or suspicious markup.
• Audit Contributor, Author, Editor, and Administrator accounts for unexpected users, recent privilege changes, and signs of compromise.
• Invalidate active sessions and rotate passwords for privileged WordPress users if suspicious event content or XSS payloads are found.
• Search web, application, and WordPress logs for low-privilege users creating or editing event content followed by administrator access to the same content.
• Temporarily restrict event creation/editing permissions until patching and content review are complete.
• Tune WAF or application-layer detections for script tags, JavaScript URLs, and HTML event handlers submitted to event schedule parameters.
• Verify vulnerability scanner results against the actual WordPress plugin version because the supplied affected package list appears unrelated to the described plugin flaw.