VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 8 known issues Latest disclosed Mar 02, 2026

EventON (Pro) - WordPress Virtual Event Calendar Plugin Vulnerabilities

Review known vulnerability records for the WordPress plugin EventON (Pro) - WordPress Virtual Event Calendar Plugin (`eventon`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2026-28037, CVE-2025-63064 and CVE-2025-47565, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
8
High or Critical
0
Patch Coverage
100%
Last Updated
Mar 12, 2026
Related Security Guides

Use these guides while reviewing EventON (Pro) - WordPress Virtual Event Calendar Plugin fixes

Pair this plugin vulnerability hub with practical WordPress hardening, scanner, and patch workflow guidance.

Hardening
WordPress hardening checklist for exposed plugins

Review patch cadence, privileged access, XML-RPC exposure, backups, and monitoring controls.
Plugin Security
WordPress plugin security basics for patch decisions

Use ownership, update testing, least privilege, and removal criteria to reduce plugin risk.
Scanning
WordPress vulnerability scanner buyer's guide

Compare scanner coverage for plugin CVEs, version detection, alert noise, and remediation workflow.
Patch Decision Workflow

How to prioritize EventON (Pro) - WordPress Virtual Event Calendar Plugin remediation

Use the hub as a decision layer before opening individual records: confirm whether the issue has a CVE, whether a fixed version exists, and whether the affected range overlaps production installs.

Search-Ready Records
8
1. Match the Package
Confirm the installed WordPress plugin slug is eventon before acting on any CVE from this cluster.
2. Sort by Severity
Start with 0 high or critical records, then review medium and unrated findings with public references.
3. Check Patch Evidence
8 records include a patch path; verify compatibility before closing the finding.
4. Monitor Gaps
0 records still lack a listed fixed release, so keep this hub in the review queue.
High-Signal Remediation Targets
CVE-2025-63064 Medium
Stored Cross-Site Scripting remediation for EventON (Pro) - WordPress Virtual Event Calendar Plugin

Affected range: Versions up to 4.9.12. Fixed version is not listed yet.

CVE-2025-3527 Medium
Stored Cross-Site Scripting remediation for EventON (Pro) - WordPress Virtual Event Calendar Plugin

Affected range: Versions up to 4.9.6. Fixed version: 4.9.7.

CVE-2026-28037 Medium
Cross-Site Scripting remediation for EventON (Pro) - WordPress Virtual Event Calendar Plugin

Affected range: Versions up to 4.9.12. Fixed version is not listed yet.

CVE-2023-7200 Medium
Cross-Site Scripting remediation for EventON (Pro) - WordPress Virtual Event Calendar Plugin

Affected range: Versions up to 4.4.0. Fixed version: 4.4.1.

Priority CVE Quick Links

Fast paths into EventON (Pro) - WordPress Virtual Event Calendar Plugin CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
8
Tracked CVE Issue Type Affected Versions Fixed Version CVSS
CVE-2025-63064
EventON Pro <= 4.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
 Stored Cross-Site Scripting Versions up to 4.9.12 No patch listed CVSS 6.4
CVE-2025-3527
EventON - WordPress Virtual Event Calendar Plugin <= 4.9.6 - Missing Authorization t...
 Stored Cross-Site Scripting Versions up to 4.9.6 4.9.7 CVSS 6.4
CVE-2026-28037
EventON <= 4.9.12 - Reflected Cross-Site Scripting
 Cross-Site Scripting Versions up to 4.9.12 No patch listed CVSS 6.1
CVE-2023-7200
EventON <= 4.4.0 - Reflected Cross-Site Scripting
 Cross-Site Scripting Versions up to 4.4.0 4.4.1 CVSS 6.1
CVE-2020-29395
EventON <= 3.0.5 - Reflected Cross-Site Scripting
 Cross-Site Scripting Versions up to 3.0.5 3.0.6 CVSS 6.1
CVE-2025-47564
EventON (Pro) <= 4.9.9 - Missing Authorization
 Vulnerability Versions up to 4.9.9 No patch listed CVSS 5.3
CVE-2025-47565
EventON <= 4.9.9 - Missing Authorization
 Vulnerability Versions up to 4.9.9 No patch listed CVSS 4.3
CVE-2023-6243
EventON PRO - WordPress Virtual Event Calendar Plugin <= 4.6.8 - Cross-Site Request...
 Cross-Site Request Forgery Versions up to 4.6.8 4.7 CVSS 4.3
CVE-2025-63064 Medium No patch listed
CVE-2025-63064 EventON (Pro) - WordPress Virtual Event Calendar Plugin Stored Cross-Site Scripting

EventON Pro <= 4.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting

CVE-2025-3527 Medium 4.9.7
CVE-2025-3527 EventON (Pro) - WordPress Virtual Event Calendar Plugin Stored Cross-Site Scripting

EventON - WordPress Virtual Event Calendar Plugin <= 4.9.6 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting

CVE-2026-28037 Medium No patch listed
CVE-2026-28037 EventON (Pro) - WordPress Virtual Event Calendar Plugin Cross-Site Scripting

EventON <= 4.9.12 - Reflected Cross-Site Scripting

CVE-2023-7200 Medium 4.4.1
CVE-2023-7200 EventON (Pro) - WordPress Virtual Event Calendar Plugin Cross-Site Scripting

EventON <= 4.4.0 - Reflected Cross-Site Scripting

CVE-2020-29395 Medium 3.0.6
CVE-2020-29395 EventON (Pro) - WordPress Virtual Event Calendar Plugin Cross-Site Scripting

EventON <= 3.0.5 - Reflected Cross-Site Scripting

CVE-2025-47564 Medium No patch listed
CVE-2025-47564 EventON (Pro) - WordPress Virtual Event Calendar Plugin Vulnerability

EventON (Pro) <= 4.9.9 - Missing Authorization

CVE-2025-47565 Medium No patch listed
CVE-2025-47565 EventON (Pro) - WordPress Virtual Event Calendar Plugin Vulnerability

EventON <= 4.9.9 - Missing Authorization

CVE-2023-6243 Medium 4.7
CVE-2023-6243 EventON (Pro) - WordPress Virtual Event Calendar Plugin Cross-Site Request Forgery

EventON PRO - WordPress Virtual Event Calendar Plugin <= 4.6.8 - Cross-Site Request Forgery via admin_test_email

Coverage Snapshot

What this page helps you verify fast

This hub clusters tracked records for EventON (Pro) - WordPress Virtual Event Calendar Plugin so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
8 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
0 critical and 0 high severity findings.
Recent CVEs
CVE-2026-28037, CVE-2025-63064 and CVE-2025-47565
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

Known Vulnerabilities

Reports for EventON (Pro) - WordPress Virtual Event Calendar Plugin

Sorted by latest disclosure date so newly published issues surface first.

Plugin Medium Patched: No CVE-2026-28037
CVE-2026-28037: EventON <= 4.9.12 - Reflected Cross-Site Scripting

The EventON plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.9.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...

Published
Mar 02, 2026
Patched Release
Not published
Affected Versions
Versions up to 4.9.12
Next Step
Open the full report for remediation notes and references.
Review CVE-2026-28037 fixed version details Open CVE Reference
Plugin Medium Patched: No CVE-2025-63064
CVE-2025-63064: EventON Pro <= 4.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting

The EventON Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.9.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to i...

Published
Oct 29, 2025
Patched Release
Not published
Affected Versions
Versions up to 4.9.12
Next Step
Open the full report for remediation notes and references.
Review CVE-2025-63064 fixed version details Open CVE Reference
Plugin Medium Patched: No CVE-2025-47565
CVE-2025-47565: EventON <= 4.9.9 - Missing Authorization

The EventON (Pro) - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 4.9.9. This makes it possible for authenticated attackers, with Subscriber-l...

Published
Jul 03, 2025
Patched Release
Not published
Affected Versions
Versions up to 4.9.9
Next Step
Open the full report for remediation notes and references.
Review CVE-2025-47565 fixed version details Open CVE Reference
Plugin Medium Patched: No CVE-2025-47564
CVE-2025-47564: EventON (Pro) <= 4.9.9 - Missing Authorization

The EventON (Pro) - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 4.9.9. This makes it possible for unauthenticated attackers to perform an un...

Published
May 16, 2025
Patched Release
Not published
Affected Versions
Versions up to 4.9.9
Next Step
Open the full report for remediation notes and references.
Review CVE-2025-47564 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-3527
CVE-2025-3527: EventON - WordPress Virtual Event Calendar Plugin <= 4.9.6 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting

The EventON Pro plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'assets/lib/settings/settings.js' file in all versions up to, and including, 4.9.6. This makes it possible for authenticated attackers, with Subscriber...

Published
May 16, 2025
Patched Release
4.9.7
Affected Versions
Versions up to 4.9.6
Next Step
Update to 4.9.7 or newer if supported.
Review CVE-2025-3527 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-6243
CVE-2023-6243: EventON PRO - WordPress Virtual Event Calendar Plugin <= 4.6.8 - Cross-Site Request Forgery via admin_test_email

The EventON PRO - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6.8. This is due to missing or incorrect nonce validation on the admin_test_email function. This makes it possible fo...

Published
Oct 18, 2024
Patched Release
4.7
Affected Versions
Versions up to 4.6.8
Next Step
Update to 4.7 or newer if supported.
Review CVE-2023-6243 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-7200
CVE-2023-7200: EventON <= 4.4.0 - Reflected Cross-Site Scripting

The EventON Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via an unknown parameter in all versions up to, and including, 4.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arb...

Published
Jan 31, 2024
Patched Release
4.4.1
Affected Versions
Versions up to 4.4.0
Next Step
Update to 4.4.1 or newer if supported.
Review CVE-2023-7200 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2020-29395
CVE-2020-29395: EventON <= 3.0.5 - Reflected Cross-Site Scripting

The EventON plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including 3.0.5. This is due to insufficient escaping and sanitization on the q= parameter. This makes it possible for unauthenticated attackers to inject arbitrary web scripts...

Published
Nov 27, 2020
Patched Release
3.0.6
Affected Versions
Versions up to 3.0.5
Next Step
Update to 3.0.6 or newer if supported.
Review CVE-2020-29395 fixed version details Open CVE Reference