EventON vulnerabilities

3 known CVE vulnerabilities in EventON, translated and rated.

CVE-2026-81791Medium
Subscriber Cross Site Scripting (XSS) in EventON <= 2.5.7 versions.
CVE-2026-9711Critical
The EventON plugin for WordPress up to version 5.0.11 is vulnerable to SQL injection via the 'search' parameter. Insufficient escaping and lack of query preparation allow unauthenticated attackers to append additional SQL queries, enabling extraction of sensitive database information if the 'Enable additional search queries' setting is enabled and at least one published event exists.
CVE-2025-63064Medium
The EventON plugin (versions up to and including 4.9.12) contains a Stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. A malicious script can be persistently stored and executed in the user's browser.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS