6.5
Medium
CVE-2023-6242 The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery…
Description
The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4 (for Pro) & 2.2.7 (for Free). This is due to missing or incorrect nonce validation on the evo_eventpost_update_meta function. This makes it possible for unauthenticated attackers to update arbitrary post metadata via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| EventON 2.2 | earliest → 2.2.7 | No fix stated |
| EventON Pro 4.5 | earliest → 4.5.4 | No fix stated |
| EventON – Events Calendar 2.2 | earliest → 2.2.7 | No fix stated |
| EventON (Pro) - WordPress Virtual Event Calendar Plugin 4.5 | earliest → 4.5.4 | No fix stated |
Other CVEs of EventON
The 9 CVEs of EventON →
CVE-2026-28037
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ashanjay EventON…
7.1
High
CVE-2025-63064
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ashanjay EventON…
6.5
Medium
CVE-2025-47565
Missing Authorization vulnerability in ashanjay EventON eventon allows Exploiting Incorrectly Configured Access…
6.3
Medium
CVE-2025-47564
Missing Authorization vulnerability in ashanjay EventON eventon allows Accessing Functionality Not Properly…
5.3
Medium