WordPress plugin
EventON – Events Calendar security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 22 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical1
- High4
- Medium16
- Low1
All EventON – Events Calendar vulnerabilities
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤2.5.7Update to 2.5.8
- Medium4.3Authenticated (Contributor+) Information Disclosure
≤2.4.7Update to 2.4.8
- Medium5.3Missing Authorization
≤2.4.4Update to 2.4.5
- High8.8Authenticated (Contributor+) Local File Inclusion
≤2.4.1Update to 2.4.2
- Critical9.8Unauthenticated Local File Inclusion
≤2.4Update to 2.4.1
- High8.8Authenticated (Contributor+) Local File Inclusion
≤2.4.1Update to 2.4.2
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤2.2.16Update to 2.2.17
- High7.2Missing Authorization to Unauthenticated Stored Cross-Site Scripting and Plugin Settings Updates
≤2.2.15Update to 2.2.16
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤2.2.14Update to 2.2.15
- Medium4.4WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.7 (Free) - Authenticated (Admin+) Stored Cross-Site Scripting
≤2.2.7Update to 2.2.8
- Medium6.1WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.7 (Free) - Reflected Cross-Site Scripting
≤2.2.7Update to 2.2.8
- Medium5.3WordPress Virtual Event Calendar Plugin <= 4.5.8 (Pro) & <= 2.2.7 (Free) - Missing Authorization via eventon_save_virtual_event_settings
≤2.2.7Update to 2.2.8
- Medium5.3WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.7 (Free) - Missing Authorization via get_virtual_users
≤2.2.7Update to 2.2.8
- Medium5.3WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.7 (Free) - Missing Authorization via config_virtual_event
≤2.2.7Update to 2.2.8
- Medium6.5WordPress Virtual Event Calendar Plugin Pro <= 4.5.4 & Free <= 2.2.7 - Missing Authorization to Arbitrary Post Meta Update via evo_eventpost_update_meta
≤2.2.7Update to 2.2.8
- Medium6.5WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.8 (Free) - Cross-Site Request Forgery via save_virtual_event_settings
≤2.2.8Update to 2.2.9
- Medium6.5WordPress Virtual Event Calendar Plugin Pro <= 4.5.4 & Free <= 2.2.7 - Cross-Site Request Forgery via evo_eventpost_update_meta
≤2.2.7Update to 2.2.8
- Low3.0Authenticated (Admin+) HTML Injection
≤2.1.7Update to 2.2
- Medium6.1Reflected Cross-Site Scripting
≤2.2.2Update to 2.2.3
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤2.1.7Update to 2.2
- Medium5.3Missing Authorization to Event Access
≤2.1Update to 2.1.2
- High7.5Insecure Direct Object Reference to Unauthorized Post Access
≤2.1Update to 2.1.2
EventON – Events Calendar: common questions
Does EventON – Events Calendar have known vulnerabilities?
Yes. VulnCrest Radar lists 22 known vulnerabilities in EventON – Events Calendar: 1 critical, 4 high, 16 medium, 1 low. None are known to affect version null.
How do I check which version of EventON – Events Calendar I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent EventON – Events Calendar vulnerability?
CVE-2026-81791, published Sep 8, 2026: EventON – Events Calendar <= 2.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting. Severity: Medium (CVSS 6.4).
Is any EventON – Events Calendar vulnerability listed in CISA KEV?
No. None of the known EventON – Events Calendar vulnerabilities is currently listed in the CISA KEV catalog.