Plugin icon

EventON – Events Calendar

eventon-lite

Vulnerabilities:

20

Last Updated:

May 28, 2026

Active Installs:

6000

Published
Title
Fixed in
CVSS
Published
2025-08-14
Title
EventON Lite < 2.4.8 - Authenticated (Contributor+) Information Disclosure
Fixed in
Fixed in 2.4.8
CVSS
4.3 (medium)
Published
2025-05-16
Title
EventON < 2.4.5 - Missing Authorization
Fixed in
Fixed in 2.4.5
CVSS
5.3 (medium)
Published
2025-05-07
Title
EventON < 2.4.2 - Authenticated (Contributor+) Local File Inclusion
Fixed in
Fixed in 2.4.2
CVSS
8.8 (high)
Published
2025-04-09
Title
EventON < 2.4.1 - Unauthenticated Local File Inclusion
Fixed in
Fixed in 2.4.1
CVSS
9.8 (critical)
Published
2025-04-04
Title
EventON < 2.4.2 - Contributor+ Local File Inclusion
Fixed in
Fixed in 2.4.2
CVSS
7.2 (high)
Published
2024-08-19
Title
EventON < 2.2.17 - Admin+ Stored XSS
Fixed in
Fixed in 2.2.17
CVSS
3.5 (low)
Published
2024-07-08
Title
EventON < 2.2.16 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting and Plugin Settings Updates
Fixed in
Fixed in 2.2.16
CVSS
7.2 (high)
Published
2024-06-22
Title
EventON < 2.2.15 - Admin+ Stored Cross-Site Scripting via event subtitle
Fixed in
Fixed in 2.2.15
CVSS
3.5 (low)
Published
2024-04-30
Title
EventON < 2.2.15 - Admin+ Stored XSS
Fixed in
Fixed in 2.2.15
CVSS
3.8 (low)
Published
2024-01-10
Title
EventON (Free < 2.2.8, Premium < 4.5.5) - Reflected XSS
Fixed in
Fixed in 2.2.8
CVSS
7.1 (high)
Published
2024-01-10
Title
EventON (Free < 2.2.8, Premium < 4.5.5) - Unauthenticated Virtual Event Password Disclosure
Fixed in
Fixed in 2.2.8
CVSS
5.9 (medium)
Published
2024-01-10
Title
EventON (Free < 2.2.9, Premium < 4.5.9) - Unauthenticated Virtual Event Settings Update
Fixed in
Fixed in 2.2.9
CVSS
5.9 (medium)
Published
2024-01-10
Title
EventON (Free < 2.2.8, Premium < 4.5.5) - Unauthenticated Email Address Disclosure
Fixed in
Fixed in 2.2.8
CVSS
5.3 (medium)
Published
2024-01-10
Title
EventON (Free < 2.2.7, Premium < 4.5.5) - Admin+ Stored Cross-Site Scripting
Fixed in
Fixed in 2.2.7
CVSS
3.5 (low)
Published
2024-01-10
Title
EventON (Free < 2.2.8, Premium < 4.5.6) - Unauthenticated Arbitrary Post Metadata Update
Fixed in
Fixed in 2.2.8
CVSS
7.5 (high)
Published
2023-11-09
Title
EventON < 2.2 - Admin + Stored HTML Injection
Fixed in
Fixed in 2.2
CVSS
3.0 (low)
Published
2023-10-20
Title
EventON < 2.2.3 - Reflected Cross Site Scripting
Fixed in
Fixed in 2.2.3
CVSS
7.1 (high)
Published
2023-09-21
Title
EventON < 2.2 - Admin+ Stored XSS
Fixed in
Fixed in 2.2
CVSS
3.5 (low)
Published
2023-06-19
Title
EventON < 2.1.2 - Unauthenticated Post Access via IDOR
Fixed in
Fixed in 2.1.2
CVSS
7.5 (high)
Published
2023-06-19
Title
EventON < 2.1.2 - Unauthenticated Event Access
Fixed in
Fixed in 2.1.2
CVSS
7.5 (high)