6.5
Moyenne
CVE-2023-6244 The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery…
Description
The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4 (Pro) & 2.2.8 (Free). This is due to missing or incorrect nonce validation on the save_virtual_event_settings function. This makes it possible for unauthenticated attackers to modify virtual event settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| EventON 2.2 | premières → 2.2.8 | Pas de correctif indiqué |
| EventON Pro 4.5 | premières → 4.5.4 | Pas de correctif indiqué |
| EventON – Events Calendar 2.2 | premières → 2.2.8 | Pas de correctif indiqué |
| EventON (Pro) - WordPress Virtual Event Calendar Plugin 4.5 | premières → 4.5.4 | Pas de correctif indiqué |
Autres CVE de EventON
Les 9 CVE de EventON →
CVE-2026-28037
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ashanjay EventON…
7.1
Élevée
CVE-2025-63064
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ashanjay EventON…
6.5
Moyenne
CVE-2025-47565
Missing Authorization vulnerability in ashanjay EventON eventon allows Exploiting Incorrectly Configured Access…
6.3
Moyenne
CVE-2025-47564
Missing Authorization vulnerability in ashanjay EventON eventon allows Accessing Functionality Not Properly…
5.3
Moyenne