EventON vulnerabilities (CVE)

CVE records published for EventON, newest first. Follow to get an email when a new one appears.

8 results

7.5High

CVE-2026-93300 14 days ago

EventON - Subscriber <= 1.4.5 - Unauthenticated SQL Injection via 'email' Parameter

EventOn EventON - Subscriber

The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the ex…

7.3High

CVE-2026-10033 3 months ago

EventON Action User <= 2.5.14 - Missing Authorization to Unauthenticated Privilege Escalation via evoau_save_capability AJAX Action

EventON EventON Action User

The EventON Action User plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.14. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauth…

9.8Critical

CVE-2026-9711 4 months ago

EventON - WordPress Virtual Event Calendar Plugin <= 5.0.11 - Unauthenticated Blind SQL Injection via Search Parameter

EventON EventON (Pro) - WordPress Virtual Event Calendar Plugin

The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress (full) is vulnerable to SQL Injection via the WordPress 'search' parameter in versions up to, and including, 5.0.11 due to insufficient escaping on the user supplied parameter and lack…

6.4Medium

CVE-2025-3527 1 year ago

EventON - WordPress Virtual Event Calendar Plugin <= 4.9.6 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting

EventON EventON (Pro) - WordPress Virtual Event Calendar Plugin

The EventON Pro plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'assets/lib/settings/settings.js' file in all versions up to, and including, 4.9.6. This makes it possible for authenticated attac…

4.3Medium

CVE-2023-6243 2 years ago

EventON PRO - WordPress Virtual Event Calendar Plugin <= 4.6.8 - Cross-Site Request Forgery via admin_test_email

EventON EventON (Pro) - WordPress Virtual Event Calendar Plugin

The EventON PRO - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6.8. This is due to missing or incorrect nonce validation on the admin_test_email function. This…

6.5Medium

CVE-2023-6242 2 years ago

EventON - WordPress Virtual Event Calendar Plugin Pro <= 4.5.4 & Free <= 2.2.7 - Cross-Site Request Forgery via evo_eventpost_update_meta

ashanjay EventON – Events Calendar; EventON EventON (Pro) - WordPress Virtual Event Calendar Plugin

The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4 (for Pro) & 2.2.7 (for Free). This is due to missing or incorrect nonce validation on the evo_ev…

6.5Medium

CVE-2023-6244 2 years ago

EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.8 (Free) - Cross-Site Request Forgery via save_virtual_event_settings

ashanjay EventON – Events Calendar; EventON EventON (Pro) - WordPress Virtual Event Calendar Plugin

The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4 (Pro) & 2.2.8 (Free). This is due to missing or incorrect nonce validation on the save_virtual_e…

6.5Medium

CVE-2023-6158 2 years ago

EventON - WordPress Virtual Event Calendar Plugin Pro <= 4.5.4 & Free <= 2.2.7 - Missing Authorization to Arbitrary Post Meta Update via evo_eventpost_update_meta

ashanjay EventON – Events Calendar; EventON EventON (Pro) - WordPress Virtual Event Calendar Plugin

The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the evo_eventpost_update_meta function in all versions up to, and including, 4.…