EventON (Pro) - WordPress Virtual Event Calendar Plugin

EventON (Pro) - WordPress Virtual Event Calendar Plugin has 18 disclosed vulnerabilities in the WordSec catalog, reported between 2020 and 2026; 13 are fixed and 5 remain unpatched as of September 2026. Their average CVSS score is 6.0, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 1 high. 2024 was the busiest year with 10 disclosures.

The most common weakness is Missing Authorization, behind 7 of the records (39%). Other recurring categories include Cross-Site Scripting, Cross-Site Request Forgery (CSRF).

13 of the records (72%) have a vendor fix, while 5 remain unpatched. The oldest unresolved one dates back to 2025.

8 independent researchers contributed these findings, most of them (4) reported by Erwan LR.

Strategic Overview

Avg CVSSMedium

6.0/ 10

Patch Coverage72%

Open

Fixed

Get automatic notifications for all EventON (Pro) - WordPress Virtual Event Calendar Plugin vulnerabilities before they are exploited.

Most severe open issueCVSS 9.8CVE-2026-9711

EventON - WordPress Virtual Event Calendar Plugin <= 5.0.11 - Unauthenticated Blind SQL Injection via Search Parameter

Read the full analysis

Vulnerability Records

18 records


2026-06-29 20:41	EventON - WordPress Virtual Event Calendar Plugin <= 5.0.11 - Unauthenticated Blind SQL Injection via Search Parameter EventON (Pro) - WordPress Virtual… <= 5.0.11	`CVE-2026-9711`	9.8 Critical	Nguyen Ngoc Duc (duc193)	No
2026-03-02 00:00	EventON <= 4.9.12 - Reflected Cross-Site Scripting EventON (Pro) - WordPress Virtual… <= 4.9.12	`CVE-2026-28037`	6.1 Medium	João Pedro Soares de Alcântara	No
2025-10-29 00:00	EventON Pro <= 4.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting EventON (Pro) - WordPress Virtual… <= 4.9.12	`CVE-2025-63064`	6.4 Medium	João Pedro Soares de Alcântara	No
2025-07-03 00:00	EventON <= 4.9.9 - Missing Authorization EventON (Pro) - WordPress Virtual… <= 4.9.9	`CVE-2025-47565`	4.3 Medium	Nguyễn Trung Kiên	No
2025-05-16 00:00	EventON - WordPress Virtual Event Calendar Plugin <= 4.9.6 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting EventON (Pro) - WordPress Virtual… <= 4.9.6	`CVE-2025-3527`	6.4 Medium	Nguyễn Trung Kiên	Yes
2025-05-16 00:00	EventON (Pro) <= 4.9.9 - Missing Authorization EventON (Pro) - WordPress Virtual… <= 4.9.9	`CVE-2025-47564`	5.3 Medium	Nguyễn Trung Kiên	No
2024-10-18 00:00	EventON PRO - WordPress Virtual Event Calendar Plugin <= 4.6.8 - Cross-Site Request Forgery via admin_test_email EventON (Pro) - WordPress Virtual… <= 4.6.8	`CVE-2023-6243`	4.3 Medium	Francesco Carlucci	Yes
2024-01-31 00:00	EventON <= 4.4.0 - Reflected Cross-Site Scripting EventON (Pro) - WordPress Virtual… <= 4.4.0	`CVE-2023-7200`	6.1 Medium	kauenavarro	Yes
2024-01-10 00:00	EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.7 (Free) - Reflected Cross-Site Scripting EventON (Pro) - WordPress Virtual… <= 4.5.4	`CVE-2024-0233`	6.1 Medium	Erwan LR	Yes
2024-01-10 00:00	EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.7 (Free) - Authenticated (Admin+) Stored Cross-Site Scripting EventON (Pro) - WordPress Virtual… <= 4.5.4	`CVE-2023-6005`	4.4 Medium	Miguel Santareno	Yes

Showing 1–10 of 18 reports