7.2
High
CVE-2024-6180 The EventON plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on…
Description
The EventON plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'eventon_import_settings' ajax action in all versions up to, and including, 2.2.15. This makes it possible for unauthenticated attackers to update plugin settings, including adding stored cross-site scripting to settings options displayed on event calendar pages.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| EventON 2.2 | earliest → 2.2.15 | No fix stated |
| eventon 2.2 | earliest → 2.2.15 | No fix stated |
| EventON – Events Calendar 2.2 | earliest → 2.2.15 | No fix stated |
Other CVEs of EventON
The 9 CVEs of EventON →
CVE-2026-28037
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ashanjay EventON…
7.1
High
CVE-2025-63064
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ashanjay EventON…
6.5
Medium
CVE-2025-47565
Missing Authorization vulnerability in ashanjay EventON eventon allows Exploiting Incorrectly Configured Access…
6.3
Medium
CVE-2025-47564
Missing Authorization vulnerability in ashanjay EventON eventon allows Accessing Functionality Not Properly…
5.3
Medium