VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 21 known issues Latest disclosed Aug 14, 2025

EventON – Events Calendar Vulnerabilities

Review known vulnerability records for the WordPress plugin EventON – Events Calendar (`eventon-lite`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2025-8091, CVE-2025-48116 and CVE-2025-47494, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
21
High or Critical
5
Patch Coverage
100%
Last Updated
Nov 05, 2025
Priority CVE Quick Links

Fast paths into EventON – Events Calendar CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
21
CVE-2025-32614 Critical 2.4.1
CVE-2025-32614 EventON – Events Calendar Local File Inclusion

EventON <= 2.4 - Unauthenticated Local File Inclusion

CVE-2025-47494 High 2.4.2
CVE-2025-47494 EventON – Events Calendar Local File Inclusion

EventON <= 2.4.1 - Authenticated (Contributor+) Local File Inclusion

CVE-2025-32160 High 2.4.2
CVE-2025-32160 EventON – Events Calendar Local File Inclusion

EventON <= 2.4.1 - Authenticated (Contributor+) Local File Inclusion

CVE-2023-3219 High 2.1.2
CVE-2023-3219 EventON – Events Calendar Authorization Bypass

EventON <= 2.1 - Insecure Direct Object Reference to Unauthorized Post Access

CVE-2024-6180 High 2.2.16
CVE-2024-6180 EventON – Events Calendar Stored Cross-Site Scripting

EventON <= 2.2.15 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting and Plugin Settings Updates

CVE-2023-6242 Medium 2.2.8
CVE-2023-6242 EventON – Events Calendar Cross-Site Request Forgery

EventON - WordPress Virtual Event Calendar Plugin Pro <= 4.5.4 & Free <= 2.2.7 - Cross-Site Request Forgery via evo_eventpost_update_meta

CVE-2023-6244 Medium 2.2.9
CVE-2023-6244 EventON – Events Calendar Cross-Site Request Forgery

EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.8 (Free) - Cross-Site Request Forgery via save_virtual_event_settings

CVE-2023-6158 Medium 2.2.8
CVE-2023-6158 EventON – Events Calendar Vulnerability

EventON - WordPress Virtual Event Calendar Plugin Pro <= 4.5.4 & Free <= 2.2.7 - Missing Authorization to Arbitrary Post Meta Update via evo_eventpost_update_meta

Coverage Snapshot

What this page helps you verify fast

This hub clusters every indexed record for EventON – Events Calendar so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
21 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
1 critical and 4 high severity findings.
Recent CVEs
CVE-2025-8091, CVE-2025-48116 and CVE-2025-47494
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

Known Vulnerabilities

Reports for EventON – Events Calendar

Sorted by latest disclosure date so newly published issues surface first.

Plugin Medium Patched: Yes CVE-2025-8091
CVE-2025-8091: EventON Lite <= 2.4.7 - Authenticated (Contributor+) Information Disclosure

The EventON Lite plugin for WordPress is vulnerable to Information Exposure in all versions less than, or equal to, 2.4.6 via the add_single_eventon and add_eventon shortcodes due to insufficient restrictions on which posts can be included. This makes it possible for unauthentica...

Published
Aug 14, 2025
Patched Release
2.4.8
Affected Versions
Versions up to 2.4.7
Next Step
Update to 2.4.8 or newer if supported.
Open CVE-2025-8091 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-48116
CVE-2025-48116: EventON <= 2.4.4 - Missing Authorization

The EventON – Events Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.4.4. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Published
May 16, 2025
Patched Release
2.4.5
Affected Versions
Versions up to 2.4.4
Next Step
Update to 2.4.5 or newer if supported.
Open CVE-2025-48116 Report Open CVE Reference
Plugin High Patched: Yes CVE-2025-47494
CVE-2025-47494: EventON <= 2.4.1 - Authenticated (Contributor+) Local File Inclusion

The EventON plugin for WordPress is vulnerable to Local File Inclusion via the evo_block_render_callback() function in versions up to, and including, 2.4.1. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitra...

Published
May 07, 2025
Patched Release
2.4.2
Affected Versions
Versions up to 2.4.1
Next Step
Update to 2.4.2 or newer if supported.
Open CVE-2025-47494 Report Open CVE Reference
Plugin Critical Patched: Yes CVE-2025-32614
CVE-2025-32614: EventON <= 2.4 - Unauthenticated Local File Inclusion

The EventON plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.4. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can...

Published
Apr 09, 2025
Patched Release
2.4.1
Affected Versions
Versions up to 2.4
Next Step
Update to 2.4.1 or newer if supported.
Open CVE-2025-32614 Report Open CVE Reference
Plugin High Patched: Yes CVE-2025-32160
CVE-2025-32160: EventON <= 2.4.1 - Authenticated (Contributor+) Local File Inclusion

The EventON plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.4.1. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the executio...

Published
Apr 04, 2025
Patched Release
2.4.2
Affected Versions
Versions up to 2.4.1
Next Step
Update to 2.4.2 or newer if supported.
Open CVE-2025-32160 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-6910
CVE-2024-6910: EventON <= 2.2.16 - Authenticated (Admin+) Stored Cross-Site Scripting

The EventON plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.2.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level p...

Published
Aug 19, 2024
Patched Release
2.2.17
Affected Versions
Versions up to 2.2.16
Next Step
Update to 2.2.17 or newer if supported.
Open CVE-2024-6910 Report Open CVE Reference
Plugin High Patched: Yes CVE-2024-6180
CVE-2024-6180: EventON <= 2.2.15 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting and Plugin Settings Updates

The EventON plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'eventon_import_settings' ajax action in all versions up to, and including, 2.2.15. This makes it possible for unauthenticated attackers to update plugin s...

Published
Jul 08, 2024
Patched Release
2.2.16
Affected Versions
Versions up to 2.2.15
Next Step
Update to 2.2.16 or newer if supported.
Open CVE-2024-6180 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-33940
CVE-2024-33940: EventON <= 2.2.14 - Authenticated (Administrator+) Stored Cross-Site Scripting

The EventON plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.2.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level p...

Published
Apr 30, 2024
Patched Release
2.2.15
Affected Versions
Versions up to 2.2.14
Next Step
Update to 2.2.15 or newer if supported.
Open CVE-2024-33940 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-0237
CVE-2024-0237: EventON - WordPress Virtual Event Calendar Plugin <= 4.5.8 (Pro) & <= 2.2.7 (Free) - Missing Authorization via eventon_save_virtual_event_settings

Multiple plugins and/or themes for WordPress are vulnerable to unauthorized modification of data due to a missing capability check on several function in various versions. This makes it possible for unauthenticated attackers to save virtual event settings.

Published
Jan 10, 2024
Patched Release
2.2.8
Affected Versions
Versions up to 2.2.7
Next Step
Update to 2.2.8 or newer if supported.
Open CVE-2024-0237 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-6005
CVE-2023-6005: EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.7 (Free) - Authenticated (Admin+) Stored Cross-Site Scripting

The EventON plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.5.4 (premium) & 2.2.7 (free) due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...

Published
Jan 10, 2024
Patched Release
2.2.8
Affected Versions
Versions up to 2.2.7
Next Step
Update to 2.2.8 or newer if supported.
Open CVE-2023-6005 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-0233
CVE-2024-0233: EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.7 (Free) - Reflected Cross-Site Scripting

The EventON plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'eid' parameter in all versions up to, and including, 4.5.4 (premium) & 2.2.7 (free) due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated att...

Published
Jan 10, 2024
Patched Release
2.2.8
Affected Versions
Versions up to 2.2.7
Next Step
Update to 2.2.8 or newer if supported.
Open CVE-2024-0233 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-0235
CVE-2024-0235: EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.7 (Free) - Missing Authorization via get_virtual_users

The EventON plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_virtual_users() function in all versions up, and including to 4.5.4 (premium) & 2.2.7 (free). This makes it possible for unauthenticated attackers to retriev...

Published
Jan 10, 2024
Patched Release
2.2.8
Affected Versions
Versions up to 2.2.7
Next Step
Update to 2.2.8 or newer if supported.
Open CVE-2024-0235 Report Open CVE Reference