The Modern Events Calendar Lite WordPress plugin before 6.2.0 alloed any logged-in user even a subscriber user may add a category whose parameters are incorrectly escaped in the admin panel leading to stored XSS.