PT-2025-16085

Name of the Vulnerable Software and Affected Versions: EventON versions prior to 2.3.2 EventON version 2.3.2 Description: The issue is related to improper control of filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File...

WordPress plugin EventON 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2025-32160

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Ashan Perera EventON eventon-lite.This issue affects EventON: from n/a through = 2.4.1...

CVE-2025-32160 WordPress EventON plugin <= 2.4.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Ashan Perera EventON eventon-lite.This issue affects EventON: from n/a through = 2.4.1...

CVE-2025-32160 WordPress EventON plugin <= 2.4.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Ashan Perera EventON eventon-lite.This issue affects EventON: from n/a through = 2.4.1...

CVE-2025-32160

CVE-2025-32160 applies to the WordPress plugin “EventON” (Ashan Perera EventON). The vulnerability is described as Improper Control of Filename for Include/Require Statement (PHP Remote File Inclusion) that affects EventON versions from n/a through 2.3.2, with a CVSS v3.1 base score of 7.5 (High)...

WordPress plugin EventON 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress EventON plugin <= 2.4 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Dimas Maulana in WordPress Plugin EventON versions = 2.4...

WordPress EventON plugin <= 2.4.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Ngô Thiên An ancorn from VNPT-VCI in WordPress Plugin EventON versions = 2.4.1...

CVE-2024-6180

The EventON plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'eventonimportsettings' ajax action in all versions up to, and including, 2.2.15. This makes it possible for unauthenticated attackers to update plugin settings, including...

Exploit for Missing Authorization in Myeventon Eventon

CVE-2024-0235-PoC The EventON WordPress plugin before 4.5.5, E...

CVE-2023-6243

The EventON PRO - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6.8. This is due to missing or incorrect nonce validation on the admintestemail function. This makes it possible for unauthenticated...

CVE-2023-6243

The EventON PRO - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6.8. This is due to missing or incorrect nonce validation on the admintestemail function. This makes it possible for unauthenticated...

CVE-2023-6243 EventON PRO - WordPress Virtual Event Calendar Plugin <= 4.6.8 - Cross-Site Request Forgery via admin_test_email

The EventON PRO - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6.8. This is due to missing or incorrect nonce validation on the admintestemail function. This makes it possible for unauthenticated...

CVE-2023-6243

The CVE-2023-6243 entry concerns EventON Pro (WordPress) up to version 4.6.8, with a Cross-Site Request Forgery (CSRF) flaw in the admin_test_email function caused by missing or improper nonce validation. This can allow unauthenticated attackers to trigger test emails to arbitrary addresses by tr...

WordPress plugin EventON PRO 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site request forge...

WordPress EventON PRO plugin <= 4.6.8 - Cross-Site Request Forgery via admin_test_email vulnerability

Cross-Site Request Forgery via admintestemail vulnerability discovered by Francesco Carlucci in WordPress Plugin EventON Pro versions = 4.6.8...

PT-2024-14910 · WordPress · Eventon Pro

Name of the Vulnerable Software and Affected Versions: The EventON PRO - WordPress Virtual Event Calendar Plugin plugin versions up to, and including, 4.6.8 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the admin test email functio...

WordPress EventON Pro Plugin <= 4.6.8 is vulnerable to Cross Site Request Forgery (CSRF)

Software EventON Pro Type Plugin Vulnerable versions = 4.6.8 Fixed in 4.7 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-6243 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 3df0e9a42423 Credits Francesco Carlucci Require...

WordPress EventON plugin < 2.2.17 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Wesley "dk4trin" Santos in WordPress Plugin EventON versions 2.2.17...