EventON – Events Calendar

EventON – Events Calendar has 21 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2025; all 21 are fixed as of September 2026. Their average CVSS score is 6.0, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 4 high. 2024 was the busiest year with 11 disclosures.

The most common weakness is Cross-Site Scripting, behind 7 of the records (33%). Other recurring categories include Missing Authorization, PHP Remote File Inclusion.

Every one of the 21 issues recorded for EventON – Events Calendar has a vendor fix available, so running the current release closes all known holes.

12 independent researchers contributed these findings, most of them (5) reported by Miguel Santareno. EventON – Events Calendar is installed on roughly 6,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

01234567891022.01.2022Today19.06.20237.5EventON <= 2.1 - Insecure Direct Object Reference to Unauthorized Post Access CVSS 7.5 · 19.06.20235.3EventON <= 2.1 - Missing Authorization to Event Access CVSS 5.3 · 19.06.202321.09.20234.4EventON <= 2.1.7 - Authenticated (Admin+) Stored Cross-Site Scripting CVSS 4.4 · 21.09.202320.10.20236.1EventON <= 2.2.2 - Reflected Cross-Site Scripting CVSS 6.1 · 20.10.202309.11.20233.0EventON <= 2.1.7 - Authenticated (Admin+) HTML Injection CVSS 3.0 · 09.11.202309.01.20246.5EventON - WordPress Virtual Event Calendar Plugin Pro <= 4.5.4 & Free <= 2.2.7 - Missing Authorization to Arbitrary Post Meta Update via evo_eventpost_update_meta CVSS 6.5 · 09.01.20246.5EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.8 (Free) - Cross-Site Request Forgery via save_virtual_event_settings CVSS 6.5 · 09.01.20246.5EventON - WordPress Virtual Event Calendar Plugin Pro <= 4.5.4 & Free <= 2.2.7 - Cross-Site Request Forgery via evo_eventpost_update_meta CVSS 6.5 · 09.01.202410.01.20245.3EventON - WordPress Virtual Event Calendar Plugin <= 4.5.8 (Pro) & <= 2.2.7 (Free) - Missing Authorization via eventon_save_virtual_event_settings CVSS 5.3 · 10.01.20246.1EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.7 (Free) - Reflected Cross-Site Scripting CVSS 6.1 · 10.01.20245.3EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.7 (Free) - Missing Authorization via config_virtual_event CVSS 5.3 · 10.01.20245.3EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.7 (Free) - Missing Authorization via get_virtual_users CVSS 5.3 · 10.01.20244.4EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.7 (Free) - Authenticated (Admin+) Stored Cross-Site Scripting CVSS 4.4 · 10.01.202430.04.20244.4EventON <= 2.2.14 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 4.4 · 30.04.202408.07.20247.2EventON <= 2.2.15 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting and Plugin Settings Updates CVSS 7.2 · 08.07.202419.08.20244.4EventON <= 2.2.16 - Authenticated (Admin+) Stored Cross-Site Scripting CVSS 4.4 · 19.08.202404.04.20258.8EventON <= 2.4.1 - Authenticated (Contributor+) Local File Inclusion CVSS 8.8 · 04.04.202509.04.20259.8EventON <= 2.4 - Unauthenticated Local File Inclusion CVSS 9.8 · 09.04.202507.05.20258.8EventON <= 2.4.1 - Authenticated (Contributor+) Local File Inclusion CVSS 8.8 · 07.05.202516.05.20255.3EventON <= 2.4.4 - Missing Authorization CVSS 5.3 · 16.05.202514.08.20254.3EventON Lite <= 2.4.7 - Authenticated (Contributor+) Information Disclosure CVSS 4.3 · 14.08.2025

Strategic Overview

Avg CVSSMedium
6.0/ 10
Patch Coverage100%
Open

0

Fixed

21

Get automatic notifications for all EventON – Events Calendar vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2025-32614

EventON <= 2.4 - Unauthenticated Local File Inclusion

Read the full analysis

Vulnerability Records

21 records
2025-08-14 20:16CVE-2025-8091
4.3
Medium
Moose LoveYes
2025-05-16 00:00CVE-2025-48116
5.3
Medium
astra.r3veriiYes
2025-05-07 00:00CVE-2025-47494
8.8
High
zaimYes
2025-04-09 00:00CVE-2025-32614
9.8
Critical
Dimas MaulanaYes
2025-04-04 00:00CVE-2025-32160
8.8
High
Ngô Thiên An (ancorn_)Yes
2024-08-19 00:00CVE-2024-6910
4.4
Medium
Wesley "dk4trin" SantosYes
2024-07-08 19:38CVE-2024-6180
7.2
High
Lucio SáYes
2024-04-30 00:00CVE-2024-33940
4.4
Medium
Van LyubovYes
2024-01-10 00:00CVE-2024-0237
5.3
Medium
Erwan LRYes
2024-01-10 00:00CVE-2024-0233
6.1
Medium
Erwan LRYes
Showing 1–10 of 21 reports
EventON – Events Calendar banner
Latestv2.5.8

EventON – Events Calendar

Ashan Perera

Author

Ashan Perera

4.1(44)
82/100
Last Updated
2026-09-10 (2d ago)
Active Installs
6,000+
Downloads
211,334
Requires WP
6.5+
Requires PHP
0+
Tested up to
WP 7.1
Created
2022-01-22 (5y ago)

EventON Lite is the free version of the #1 best-selling Event Calendar plugin on Codecanyon (63,000+ paid installations worldwide since 2011). Create a professional, fast, and beautiful event calendar in minutes — no coding required. Perfect for blogs, businesses, churches, schools, communities, and anyone who wants to showcase events without clutter or bloat. Display your events in a sleek, minimal, and responsive layout that’s designed to impress. Create unlimited events, choose from endless color options, and organize them with custom categories. Plus, the interactive Shortcode Generator makes it simple to add event calendars to any page or post—directly in the WP Block editor. Start Building Your Event Calendar Today! See EventON calendar in action at EventON Lite Demo and experience its ease of use! Ready to take your event calendar to next level and unlock advanced features like tickets, RSVP, Seats, and more? Check out EventON Full Version and EventON Addons Experience EventON Full version before you buy at EventON Full Demo and EventON Addons Demo. Why people love EventON Lite Clean, modern, fully responsive design that looks great out of the box Unlimited events, colors, and categories Powerful repeating schedules (daily, weekly, monthly, yearly + custom) Virtual events support Google Maps + event organizers Search, filter, and sort events easily SEO-ready with Event Schema & JSON-LD Interactive Shortcode Generator + Gutenberg block OpenAI integration to help write event titles, descriptions, and social posts Lightweight and focused — no unnecessary features Key Features Calendar Experience Multiple views: Month, Schedule, Tile, Live Now Gradient event colors and custom icons (Font Awesome) Month jumper, load more events, and limit number of events shown Responsive on every device Open events as lightbox, slide-down, new page, or external link Show only featured events or hide past/cancelled events Event Creation Power Unlimited events with featured images Single-day, multi-day, all-day, month-long, and year-long events Repeating events (daily, weekly, monthly, yearly, custom) Virtual events with attendance modes Event location + Google Maps + Directions Event organizers Custom meta fields Event categories (multiple event types + tags) Feature and prioritize important events Different timezones per event + “view in visitor’s local time” Add to Google Calendar & iCal Discovery & Engagement Event search Sort & filter by category, type, and more Related events Single event box you can place anywhere Widgets for sidebars Location & Organizer archive pages Ease of Use & Design Interactive Shortcode Generator (works in Classic Editor and Blocks) EventCard Designer with multiple layouts Quick edit & bulk edit Built-in language translations Custom CSS support Download all events as CSV or ICS Technical & SEO Event Schema and JSON-LD markup for better search visibility Basic PayPal payments support OpenAI integration for titles, subtitles, descriptions, and X (Twitter) posts Accessible future repeat instances Members-only calendar option Ideal for Community calendars and local event listings Workshops, webinars, meetups, and recurring classes Church services and school activities Blogs and websites that want a beautiful free calendar without bloat Nonprofits, clubs, and small businesses See it live: EventON Lite Demo ! EventON Documentation & Support Stuck? Check out Documentation Library. You can also reach out via WordPress.org forum. Ready to Upgrade to EventON Full Version ? Ready to Upgrade to EventON Full Version? Grab the The EventON Full version and elevate your event experience to the next level! Why upgrade to EventON Full version? Full Integration: Access premium addons like Tickets, RSVP, Seats, and more to make your events unforgettable. Advanced Customizations: Unlock unique layouts, designs, and enhanced event features to personalize your events. More Event Views: Enjoy flexible display options with grid, weekly, or yearly views tailored to your needs. Multi View Switcher: Seamlessly switch between different event views for versatile event displays. Advanced Search Capabilities: Easily find events with advanced search options, including taxonomies, subtitles, and postmeta values. Quick Event Editing: Enable the edit event icon for effortless event updates right from the event top. Zoom OAuth Integration: Seamlessly integrate with Zoom for smooth virtual event management. Link from Anywhere: Direct users to single event pages from anywhere, simplifying navigation. Multiple Organizers: Assign several organizers to an event for collaborative planning. Enhanced Filters: Use event filter reset and active features for a more dynamic search experience. Autonomous Functions: Automate event management by auto-moving past events to trash and marking them as completed. Virtual Event Content: Add engaging post-event virtual content to keep your audience connected. Custom Google Map Styles: Personalize event locations with unique Google Map styles. EventCard Designer: Choose from 7 layouts to create visually appealing event cards. EventTop Designer: Customize the top section of your events for a standout look. Multi Data Types Support: Create versatile content types that can be reused across multiple events and updated all at once for consistent event management. Language corresponding event: Assign languages to events and create calendars that display events in specific languages for targeted audience engagement. Dedicated Support: Receive expert assistance via helpdesk.ashanjay.com to ensure your events run smoothly. Support for All EventON Addons: Maximize your event potential with full compatibility with all EventON addons. For complete list of features –> Comparisons EventON Addons The EventON Full + EventON Addons = Super charge your event calendar with tickets, countdowns, seats etc. Explore all our addons at EventON Addons Our Most Popular Addons: FullCal Addon – Display your calendar in a grid style Event Tickets – Sell tickets to your events with this addon that is powered by Woocommerce and pay only payment processing fees. ActionUser – Allows front-end event submission to users, curate user permissions to calendar and front-end Event Manger RSVP Events – This allow your attendees to RSVP without the need of tickets. DailyView Addon – If you have many events, this is the perfect addon to show just the events that are taking place today. WeeklyView Addon – Display events for a week at a time using our WeeklyView Addon. YearlyView Addon – Show 12 months, an entire year of events in one setting in an elegant yearly calendar view. EventMap Addon – Add a google map API based map with all the events on monthly or all upcoming basis and show your events on a map format. Speakers & Schedule Addon – Setup speakers and their schedule for the event that is seamlessly integrated on EventCard. Event Slider Addon – Convert your events into a beautifully crafted slider of events that place events on spotlight. Seats Addon – Convert your regular event tickets into interactive and handpickable seats from the seat map. Event Countdown Addon – Display a real-time countdown timer for events to increase demand for your events and drive audience attention. Our Newest Addon! Check-ins – Boost your events with Check-Ins: a fast, user-friendly addon delivering seamless guest check-ins and real-time attendance insights. Check out all EventON Addons.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C