CVE-2025-63064
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The EventON plugin (versions up to and including 4.9.12) contains a Stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. A malicious script can be persistently stored and executed in the user's browser.
Risk Assessment
An attacker could inject a persistent malicious script that executes in the browsers of site visitors or administrators. This may lead to session theft, account takeover, or website content modification.
Recommendation
Update the EventON plugin to a version newer than 4.9.12 once a fix is available. Also check the site content for any injected malicious scripts.
Other vulnerabilities in EventON
See all- CVE-2026-81791Medium
Subscriber Cross Site Scripting (XSS) in EventON <= 2.5.7 versions.
- CVE-2026-9711Critical
The EventON plugin for WordPress up to version 5.0.11 is vulnerable to SQL injection via the 'search' parameter. Insufficient escaping and lack of query preparation allow unauthenticated attackers to append additional SQL queries, enabling extraction of sensitive database information if the 'Enable additional search queries' setting is enabled and at least one published event exists.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ashanjay EventON eventon allows Stored XSS.This issue affects EventON: from n/a through <= 4.9.12.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS