7.2
Élevée
CVE-2024-6180 The EventON plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on…
Description
The EventON plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'eventon_import_settings' ajax action in all versions up to, and including, 2.2.15. This makes it possible for unauthenticated attackers to update plugin settings, including adding stored cross-site scripting to settings options displayed on event calendar pages.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| EventON 2.2 | premières → 2.2.15 | Pas de correctif indiqué |
| eventon 2.2 | premières → 2.2.15 | Pas de correctif indiqué |
| EventON – Events Calendar 2.2 | premières → 2.2.15 | Pas de correctif indiqué |
Autres CVE de EventON
Les 9 CVE de EventON →
CVE-2026-28037
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ashanjay EventON…
7.1
Élevée
CVE-2025-63064
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ashanjay EventON…
6.5
Moyenne
CVE-2025-47565
Missing Authorization vulnerability in ashanjay EventON eventon allows Exploiting Incorrectly Configured Access…
6.3
Moyenne
CVE-2025-47564
Missing Authorization vulnerability in ashanjay EventON eventon allows Accessing Functionality Not Properly…
5.3
Moyenne