CVE-2026-81791

MediumCVSS 6.5

Published: 10/09/2026(UTC)Updated: 10/09/2026(UTC)Translated: 10/09/2026(UTC)NVD NIST

Summary

Subscriber Cross Site Scripting (XSS) in EventON <= 2.5.7 versions.

Risk Assessment

A low-privileged user can inject scripts that execute in other users' browsers, leading to session theft or phishing.

Recommendation

Update the EventON plugin to a version later than 2.5.7.

Other vulnerabilities in EventON

CVE-2026-9711Critical
The EventON plugin for WordPress up to version 5.0.11 is vulnerable to SQL injection via the 'search' parameter. Insufficient escaping and lack of query preparation allow unauthenticated attackers to append additional SQL queries, enabling extraction of sensitive database information if the 'Enable additional search queries' setting is enabled and at least one published event exists.

Original NVD description (English source)

Subscriber Cross Site Scripting (XSS) in EventON <= 2.5.7 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS