Exploit for Modern Events Calendar Lite < 5.22.2 - Admin+ Stored Cross-Site Scripting CVE-2021-24687

Name: Exploit for Modern Events Calendar Lite < 5.22.2 - Admin+ Stored Cross-Site Scripting CVE-2021-24687
Rating: 5 (280 reviews)

2021-09-06 | CVSS 3.5

## https://sploitus.com/exploit?id=WPEX-ID:300BA418-63ED-4C03-9031-263742ED522E
Go to the plugin Settings > Messages > Taxonomies (/wp-admin/admin.php?page=MEC-settings&tab=MEC-messages)

Put the following payload in the Category Plural Label, Category Plural Label or Label Plural Label fields: "><script>alert(/XSS/)</script>

The XSS will be triggered in any backend pages