Myeventon
Myeventon Eventon: vulnerabilidades y CVE
Myeventon Eventon tiene 28 vulnerabilidades publicadas, 4 de ellas en los últimos 12 meses. 1 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE28
Últimos 12 meses4
Críticas1
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-81791 | Media (6.5) | 0.22% | — | 10 sept 2026 | Subscriber Cross Site Scripting (XSS) in EventON <= 2.5.7 versions. |
| CVE-2026-9711 | Crítica (9.8) | 0.54% | — | 30 jun 2026 | The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress (full) is vulnerable to SQL Injection via the WordPress 'search' parameter in versions up to, and including, 5.0.11 due to insufficient escaping… |
| CVE-2026-28037 | Alta (7.1) | 0.26% | — | 5 mar 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ashanjay EventON eventon allows Reflected XSS.This issue affects EventON: from n/a through <= 4.9.12. |
| CVE-2025-63064 | Media (6.5) | 0.23% | — | 9 dic 2025 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ashanjay EventON eventon allows Stored XSS.This issue affects EventON: from n/a through <= 4.9.12. |
| CVE-2025-47565 | Media (6.3) | 0.25% | — | 4 jul 2025 | Missing Authorization vulnerability in ashanjay EventON eventon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventON: from n/a through <= 4.9.9. |
| CVE-2025-3527 | Media (5.4) | 0.20% | — | 17 may 2025 | The EventON Pro plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'assets/lib/settings/settings.js' file in all versions up to, and including, 4.9.6. This… |
| CVE-2025-47564 | Media (5.3) | 0.40% | — | 16 may 2025 | Missing Authorization vulnerability in ashanjay EventON eventon allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects EventON: from n/a through <= 4.9.8. |
| CVE-2025-47494 | Alta (7.5) | 0.73% | — | 7 may 2025 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ashan Perera EventON eventon-lite allows PHP Local File Inclusion.This issue affects EventON: from… |
| CVE-2025-32160 | Alta (7.5) | 0.80% | — | 10 abr 2025 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ashan Perera EventON eventon-lite.This issue affects EventON: from n/a through <= 2.4.1. |
| CVE-2024-6910 | Media (4.8) | 0.35% | — | 9 sept 2024 | The EventON WordPress plugin before 2.2.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is… |
| CVE-2024-4752 | Media (5.9) | 0.40% | — | 13 jul 2024 | The EventON WordPress plugin before 2.2.15 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the… |
| CVE-2024-6180 | Alta (7.2) | 0.46% | — | 9 jul 2024 | The EventON plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'eventon_import_settings' ajax action in all versions up to, and including, 2.2.15. This makes… |
| CVE-2024-33940 | Media (5.9) | 0.34% | — | 3 may 2024 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashan Jay EventON allows Stored XSS.This issue affects EventON: from n/a through 2.2.14. |
| CVE-2023-7200 | Media (6.1) | 0.43% | — | 29 ene 2024 | The EventON WordPress plugin before 4.4.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such… |
| CVE-2024-0238 | Media (6.1) | 0.37% | — | 16 ene 2024 | The EventON Premium WordPress plugin before 4.5.6, EventON WordPress plugin before 2.2.8 do not have authorisation in an AJAX action, and does not ensure that the post to be updated belong to the plugin, allowing… |
| CVE-2024-0237 | Media (5.3) | 0.41% | — | 16 ene 2024 | The EventON WordPress plugin through 4.5.8, EventON WordPress plugin before 2.2.7 do not have authorisation in some AJAX actions, allowing unauthenticated users to update virtual events settings, such as meeting URL,… |
| CVE-2024-0236 | Media (5.3) | 0.45% | — | 16 ene 2024 | The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unauthenticated users to retrieve the settings of arbitrary virtual events,… |
| CVE-2024-0235 | Media (5.3) | 38% | — | 16 ene 2024 | The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unauthenticated users to retrieve email addresses of any users on the blog |
| CVE-2024-0233 | Media (6.1) | 0.37% | — | 16 ene 2024 | The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not properly sanitise and escape a parameter before outputting it back in pages, leading to a Reflected Cross-Site Scripting which… |
| CVE-2023-6046 | Media (4.8) | 0.43% | — | 16 ene 2024 | The EventON WordPress plugin before 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored HTML Injection attacks even when the unfiltered_html… |
| CVE-2023-6005 | Media (4.8) | 0.43% | — | 16 ene 2024 | The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site… |
| CVE-2023-6244 | Media (4.3) | 0.25% | — | 11 ene 2024 | The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4 (Pro) & 2.2.8 (Free). This is due to missing or… |
| CVE-2023-6242 | Media (4.3) | 0.26% | — | 11 ene 2024 | The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4 (for Pro) & 2.2.7 (for Free). This is due to missing or… |
| CVE-2023-6158 | Media (6.5) | 0.56% | — | 10 ene 2024 | The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the evo_eventpost_update_meta function… |
| CVE-2023-4388 | Media (4.8) | 0.40% | — | 16 oct 2023 | The EventON WordPress plugin before 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the… |
| CVE-2023-3219 | Media (5.3) | 7.5% | — | 10 jul 2023 | The EventON WordPress plugin before 2.1.2 does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid Event, allowing unauthenticated visitors to access any Post (including… |
| CVE-2023-2796 | Media (5.3) | 43% | — | 10 jul 2023 | The EventON WordPress plugin before 2.1.2 lacks authentication and authorization in its eventon_ics_download ajax action, allowing unauthenticated visitors to access private and password protected Events by guessing… |
| CVE-2020-29395 | Media (6.1) | 13% | — | 30 nov 2020 | The EventON plugin through 3.0.5 for WordPress allows addons/?q= XSS via the search field. |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.