EventON Lite <= 2.4 - Authenticated Local File Inclusion

Ashan Perera EventON contains a PHP remote file inclusion caused by improper control of filename in include/require statements, letting attackers include local files, exploit requires attacker to control include filename. id: CVE-2025-32614 info: name: EventON Lite = 2.4 - Authenticated Local Fil...

EventON (Free < 2.2.8, Premium < 4.5.5) - Information Disclosure

The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorization in an AJAX action, allowing unauthenticated users to retrieve email addresses of any users on the blog. id: CVE-2024-0235 info: name: EventON Free 2.2.8, Premium 4.5.5 - Information Disclosu...

EventON Lite < 2.1.2 - Arbitrary File Download

The plugin does not validate that the eventid parameter in its eventonicsdownload ajax action is a valid Event, allowing unauthenticated visitors to access any Post including unpublished or protected posts content via the ics export functionality by providing the numeric id of the post. id:...

EventON <= 2.1 - Missing Authorization

The EventON WordPress plugin before 2.1.2 lacks authentication and authorization in its eventonicsdownload ajax action, allowing unauthenticated visitors to access private and password protected Events by guessing their numeric id. id: CVE-2023-2796 info: name: EventON = 2.1 - Missing Authorizati...

Wordpress EventON Calendar 3.0.5 - Cross-Site Scripting

Wordpress EventON Calendar 3.0.5 is vulnerable to cross-site scripting because it allows addons/?q= XSS via the search field. id: CVE-2020-29395 info: name: Wordpress EventON Calendar 3.0.5 - Cross-Site Scripting author: daffainfo severity: medium description: Wordpress EventON Calendar 3.0.5 is...

CVE-2024-0235-PoC

CVE-2024-0235-PoC 4.5.5 이전 버전의 EventON WordPress 플러그인과 2.2.7 이전 버전의 EventON WordPress 플러그인은 AJAX 액션에서 권한 검사를 수행하지 않으므로, 인증되지 않은 사용자가 블로그의 모든 사용자의 이메일 주소를 검색할 수 있습니다. 사용법: usage: CVE-2024-0235.py -h --url URL CVE-2024-0235.py: error: the following arguments are required: --url/-u...

EventON-Lite-CVE-Report

EventON-Lite-CVE-Report CVE-2025-8091 공개 CVE-2025-8091 - EventON Lite의 취약점 이 저장소는 Ashan Perera가 개발한 WordPress 플러그인 EventON Lite = 2.4.6에서 발견된 취약점을 공개합니다. 🛠 영향을 받는 버전 제품 : EventON Lite 버전 : v2.4.6 URL : https://wordpress.org/plugins/eventon-lite/ 🔒 할당된 CVE CVE ID| 유형| 구성 요소| 영향 ---|---|---|---...

CVE-2026-81791

Subscriber Cross Site Scripting XSS in EventON = 2.5.7 versions...

CVE-2026-81791 WordPress EventON plugin <= 2.5.7 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in EventON = 2.5.7 versions...

CVE-2026-81791

The WordPress EventON plugin , versions

CVE-2026-81791 WordPress EventON plugin <= 2.5.7 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in EventON = 2.5.7 versions...

EUVD-2026-75523

Subscriber Cross Site Scripting XSS in EventON = 2.5.7 versions...

CVE-2026-81791: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in EventON = 2.5.7 versions...

PT-2026-89437

Subscriber Cross Site Scripting XSS in EventON = 2.5.7 versions...

WordPress EventON plugin <= 2.5.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin EventON versions = 2.5.7...

WordPress EventON Action User plugin <= 2.5.14 - Missing Authorization to Unauthenticated Privilege Escalation vulnerability

Missing Authorization to Unauthenticated Privilege Escalation vulnerability discovered by Vincent Szopa bioflavonoid in WordPress Plugin EventON Action User versions = 2.5.14...

CVE-2026-10033

The EventON Action User plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.14. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to grant EventON...

CVE-2026-10033 EventON Action User <= 2.5.14 - Missing Authorization to Unauthenticated Privilege Escalation via evoau_save_capability AJAX Action

The EventON Action User plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.14. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to grant EventON...

CVE-2026-10033

The EventON Action User plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.14. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to grant EventON...

EUVD-2026-48550

The EventON Action User plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.14. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to grant EventON...