# EventON (Pro) - WordPress Virtual Event Calendar Plugin

> Not on WordPress.org: a premium or commercial plugin that updates from its vendor.

Source: https://todaywp.com (Today WP, free and read-only). 

## Facts

- Slug: eventon
- To check an installed version: wp_security with plugins "eventon:<version>".

## Known vulnerabilities

- 2026-06-30 CRITICAL: WordPress Virtual Event Calendar Plugin <= 5.0.11 - Unauthenticated Blind SQL Injection via Search Parameter (up to 5.0.11). CVE-2026-9711, https://www.wordfence.com/threat-intel/vulnerabilities/id/1b5a0c87-59b0-4da4-8949-0957f8e1b479?source=api-prod
- 2026-03-02 MEDIUM: Reflected Cross-Site Scripting (up to 4.9.12). CVE-2026-28037, https://www.wordfence.com/threat-intel/vulnerabilities/id/c98cd47b-075a-44c4-8755-02f474f9ca42?source=api-prod
- 2025-10-29 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 4.9.12). CVE-2025-63064, https://www.wordfence.com/threat-intel/vulnerabilities/id/3bba8002-8106-493c-aeb2-b7189190fb3d?source=api-prod
- 2025-07-03 MEDIUM: Missing Authorization (up to 4.9.9). CVE-2025-47565, https://www.wordfence.com/threat-intel/vulnerabilities/id/67e45e8d-c0f1-42c1-9b51-4c1cadea8e48?source=api-prod
- 2025-05-16 MEDIUM: WordPress Virtual Event Calendar Plugin <= 4.9.6 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting (up to 4.9.6). CVE-2025-3527, https://www.wordfence.com/threat-intel/vulnerabilities/id/549ca9cf-0183-4c19-9bd5-b6d55a69df31?source=api-prod
- 2025-05-16 MEDIUM: Missing Authorization (up to 4.9.9). CVE-2025-47564, https://www.wordfence.com/threat-intel/vulnerabilities/id/c0163382-9b53-4c74-b9bd-c3baa14faee1?source=api-prod
- 2024-10-18 MEDIUM: WordPress Virtual Event Calendar Plugin <= 4.6.8 - Cross-Site Request Forgery via admin_test_email (up to 4.6.8). CVE-2023-6243, https://www.wordfence.com/threat-intel/vulnerabilities/id/1d0a40f8-4c31-447d-ac28-73cfe7a07687?source=api-prod
- 2024-01-31 MEDIUM: Reflected Cross-Site Scripting (up to 4.4.0). CVE-2023-7200, https://www.wordfence.com/threat-intel/vulnerabilities/id/e0d5b1a5-0078-402b-b834-8091bfc02dd5?source=api-prod
- 2024-01-10 MEDIUM: WordPress Virtual Event Calendar Plugin <= 4.5.8 (Pro) & <= 2.2.7 (Free) - Missing Authorization via eventon_save_virtual_event_settings (up to 4.5.8). WF-220ca462-6a5b-440e-badf-d253e2b6b1f0-1, https://www.wordfence.com/threat-intel/vulnerabilities/id/220ca462-6a5b-440e-badf-d253e2b6b1f0?source=api-prod
- 2024-01-10 MEDIUM: WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.7 (Free) - Reflected Cross-Site Scripting (up to 4.5.4). WF-67fc4141-7875-459b-98d8-d14e0a6f566c-1, https://www.wordfence.com/threat-intel/vulnerabilities/id/67fc4141-7875-459b-98d8-d14e0a6f566c?source=api-prod
- 2024-01-10 MEDIUM: WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.7 (Free) - Missing Authorization via config_virtual_event (up to 4.5.4). WF-ae603d27-aea5-49d9-beab-db18746ffe87-1, https://www.wordfence.com/threat-intel/vulnerabilities/id/ae603d27-aea5-49d9-beab-db18746ffe87?source=api-prod
- 2024-01-10 MEDIUM: WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.7 (Free) - Missing Authorization via get_virtual_users (up to 4.5.4). WF-d2994fbb-29b0-4725-a046-edeca4bcbcd7-1, https://www.wordfence.com/threat-intel/vulnerabilities/id/d2994fbb-29b0-4725-a046-edeca4bcbcd7?source=api-prod
- 2024-01-10 MEDIUM: WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.7 (Free) - Authenticated (Admin+) Stored Cross-Site  Scripting (up to 4.5.4). WF-ec2daf19-51ef-4e1b-becb-252955a61523-1, https://www.wordfence.com/threat-intel/vulnerabilities/id/ec2daf19-51ef-4e1b-becb-252955a61523?source=api-prod
- 2024-01-09 MEDIUM: WordPress Virtual Event Calendar Plugin Pro <= 4.5.4 & Free <= 2.2.7 - Missing Authorization to Arbitrary Post Meta Update via... (up to 4.5.4). WF-19f94c4f-145b-4058-aabd-06525fce3cea-1, https://www.wordfence.com/threat-intel/vulnerabilities/id/19f94c4f-145b-4058-aabd-06525fce3cea?source=api-prod
- 2024-01-09 MEDIUM: WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.8 (Free) - Cross-Site Request Forgery via save_virtual_event_settings (up to 4.5.4). WF-6fcc3a82-f116-446e-9e5f-4f074e20403b-1, https://www.wordfence.com/threat-intel/vulnerabilities/id/6fcc3a82-f116-446e-9e5f-4f074e20403b?source=api-prod
- 2024-01-09 MEDIUM: WordPress Virtual Event Calendar Plugin Pro <= 4.5.4 & Free <= 2.2.7 - Cross-Site Request Forgery via evo_eventpost_update_meta (up to 4.5.4). WF-c8e9a333-a6b7-4b5e-93c1-b95566e5d6fb-1, https://www.wordfence.com/threat-intel/vulnerabilities/id/c8e9a333-a6b7-4b5e-93c1-b95566e5d6fb?source=api-prod
- 2023-06-19 HIGH: Insecure Direct Object Reference to Unauthorized Post Access (before 4.4). WF-1485dda6-bf83-4076-80c9-dc7ea9d58155-1, https://www.wordfence.com/threat-intel/vulnerabilities/id/1485dda6-bf83-4076-80c9-dc7ea9d58155?source=api-prod
- 2020-11-27 MEDIUM: Reflected Cross-Site Scripting (up to 3.0.5). CVE-2020-29395, https://www.wordfence.com/threat-intel/vulnerabilities/id/577b4738-fa58-44b2-a8e7-ef59925f26a1?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.