WordPress plugin
EventON – Events Calendar security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 22 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical1
- High4
- Medium16
- Low1
All EventON – Events Calendar vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High8.8 | Authenticated (Contributor+) Local File Inclusion ≤2.4.1Update to 2.4.2 | CVE-2025-47494 | |
| Critical9.8 | Unauthenticated Local File Inclusion ≤2.4Update to 2.4.1 | CVE-2025-32614 | |
| High8.8 | Authenticated (Contributor+) Local File Inclusion ≤2.4.1Update to 2.4.2 | CVE-2025-32160 | |
| High7.2 | Missing Authorization to Unauthenticated Stored Cross-Site Scripting and Plugin Settings Updates ≤2.2.15Update to 2.2.16 | CVE-2024-6180 | |
| High7.5 | Insecure Direct Object Reference to Unauthorized Post Access ≤2.1Update to 2.1.2 | CVE-2023-3219 |
- High8.8Authenticated (Contributor+) Local File Inclusion
≤2.4.1Update to 2.4.2
- Critical9.8Unauthenticated Local File Inclusion
≤2.4Update to 2.4.1
- High8.8Authenticated (Contributor+) Local File Inclusion
≤2.4.1Update to 2.4.2
- High7.2Missing Authorization to Unauthenticated Stored Cross-Site Scripting and Plugin Settings Updates
≤2.2.15Update to 2.2.16
- High7.5Insecure Direct Object Reference to Unauthorized Post Access
≤2.1Update to 2.1.2
EventON – Events Calendar: common questions
Does EventON – Events Calendar have known vulnerabilities?
Yes. VulnCrest Radar lists 22 known vulnerabilities in EventON – Events Calendar: 1 critical, 4 high, 16 medium, 1 low. None are known to affect version null.
How do I check which version of EventON – Events Calendar I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent EventON – Events Calendar vulnerability?
CVE-2026-81791, published Sep 8, 2026: EventON – Events Calendar <= 2.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting. Severity: Medium (CVSS 6.4).
Is any EventON – Events Calendar vulnerability listed in CISA KEV?
No. None of the known EventON – Events Calendar vulnerabilities is currently listed in the CISA KEV catalog.