WordSec
WordSec

EventON (Pro) - WordPress Virtual Event Calendar Plugin

Explore EventON (Pro) - WordPress Virtual Event Calendar Plugin vulnerabilities across all versions. Currently tracking 18 known vulnerabilities, including severity, impact, and patch status.

01234567891027.11.2020Today27.11.20206.1EventON <= 3.0.5 - Reflected Cross-Site Scripting CVSS 6.1 · 27.11.202019.06.20237.5EventON <= 2.1 - Insecure Direct Object Reference to Unauthorized Post Access CVSS 7.5 · 19.06.202309.01.20246.5EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.8 (Free) - Cross-Site Request Forgery via save_virtual_event_settings CVSS 6.5 · 09.01.20246.5EventON - WordPress Virtual Event Calendar Plugin Pro <= 4.5.4 & Free <= 2.2.7 - Cross-Site Request Forgery via evo_eventpost_update_meta CVSS 6.5 · 09.01.20246.5EventON - WordPress Virtual Event Calendar Plugin Pro <= 4.5.4 & Free <= 2.2.7 - Missing Authorization to Arbitrary Post Meta Update via evo_eventpost_update_meta CVSS 6.5 · 09.01.202410.01.20246.1EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.7 (Free) - Reflected Cross-Site Scripting CVSS 6.1 · 10.01.20244.4EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.7 (Free) - Authenticated (Admin+) Stored Cross-Site Scripting CVSS 4.4 · 10.01.20245.3EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.7 (Free) - Missing Authorization via get_virtual_users CVSS 5.3 · 10.01.20245.3EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.7 (Free) - Missing Authorization via config_virtual_event CVSS 5.3 · 10.01.20245.3EventON - WordPress Virtual Event Calendar Plugin <= 4.5.8 (Pro) & <= 2.2.7 (Free) - Missing Authorization via eventon_save_virtual_event_settings CVSS 5.3 · 10.01.202431.01.20246.1EventON <= 4.4.0 - Reflected Cross-Site Scripting CVSS 6.1 · 31.01.202418.10.20244.3EventON PRO - WordPress Virtual Event Calendar Plugin <= 4.6.8 - Cross-Site Request Forgery via admin_test_email CVSS 4.3 · 18.10.202416.05.20256.4EventON - WordPress Virtual Event Calendar Plugin <= 4.9.6 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting CVSS 6.4 · 16.05.20255.3EventON (Pro) <= 4.9.9 - Missing Authorization CVSS 5.3 · 16.05.202503.07.20254.3EventON <= 4.9.9 - Missing Authorization CVSS 4.3 · 03.07.202529.10.20256.4EventON Pro <= 4.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 29.10.202502.03.20266.1EventON <= 4.9.12 - Reflected Cross-Site Scripting CVSS 6.1 · 02.03.202629.06.20269.8EventON - WordPress Virtual Event Calendar Plugin <= 5.0.11 - Unauthenticated Blind SQL Injection via Search Parameter CVSS 9.8 · 29.06.2026

Strategic Overview

Avg CVSSMedium
6.0/ 10
Patch Coverage72%
Open

5

Fixed

13

Get automatic notifications for all EventON (Pro) - WordPress Virtual Event Calendar Plugin vulnerabilities before they are exploited.

Vulnerability Records

18 records
2026-06-29 20:41
EventON - WordPress Virtual Event Calendar Plugin <= 5.0.11 - Unauthenticated Blind SQL Injection via Search Parameter
EventON (Pro) - WordPress Virtual Event…
<= 5.0.11
CVE-2026-9711
9.8
Critical
Nguyen Ngoc Duc (duc193)No
2026-03-02 00:00
EventON <= 4.9.12 - Reflected Cross-Site Scripting
EventON (Pro) - WordPress Virtual Event…
<= 4.9.12
CVE-2026-28037
6.1
Medium
João Pedro Soares de AlcântaraNo
2025-10-29 00:00
EventON Pro <= 4.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
EventON (Pro) - WordPress Virtual Event…
<= 4.9.12
CVE-2025-63064
6.4
Medium
João Pedro Soares de AlcântaraNo
2025-07-03 00:00
EventON <= 4.9.9 - Missing Authorization
EventON (Pro) - WordPress Virtual Event…
<= 4.9.9
CVE-2025-47565
4.3
Medium
Nguyễn Trung KiênNo
2025-05-16 00:00
EventON - WordPress Virtual Event Calendar Plugin <= 4.9.6 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
EventON (Pro) - WordPress Virtual Event…
<= 4.9.6
CVE-2025-3527
6.4
Medium
Nguyễn Trung KiênYes
2025-05-16 00:00
EventON (Pro) <= 4.9.9 - Missing Authorization
EventON (Pro) - WordPress Virtual Event…
<= 4.9.9
CVE-2025-47564
5.3
Medium
Nguyễn Trung KiênNo
2024-10-18 00:00
EventON PRO - WordPress Virtual Event Calendar Plugin <= 4.6.8 - Cross-Site Request Forgery via admin_test_email
EventON (Pro) - WordPress Virtual Event…
<= 4.6.8
CVE-2023-6243
4.3
Medium
Francesco CarlucciYes
2024-01-31 00:00
EventON <= 4.4.0 - Reflected Cross-Site Scripting
EventON (Pro) - WordPress Virtual Event…
<= 4.4.0
CVE-2023-7200
6.1
Medium
kauenavarroYes
2024-01-10 00:00
EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.7 (Free) - Reflected Cross-Site Scripting
EventON (Pro) - WordPress Virtual Event…
<= 4.5.4
CVE-2024-0233
6.1
Medium
Erwan LRYes
2024-01-10 00:00
EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.7 (Free) - Authenticated (Admin+) Stored Cross-Site Scripting
EventON (Pro) - WordPress Virtual Event…
<= 4.5.4
CVE-2023-6005
4.4
Medium
Miguel SantarenoYes
Showing 1–10 of 18 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C