CVE-2024-0236: The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unauthenticated users to retrieve the settings of arbitrary virtu

medium Affects eventon (WordPress plugin). Feed 2026.10.29.4, updated 2026-10-29; published 2024-01-16; advisory modified 2026-06-17.

The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unauthenticated users to retrieve the settings of arbitrary virtu

Package: eventon (WordPress plugin) WordPress
Affected versions: <2.2.7 or >=4.0 and <4.5.5
Fixed in: 2.2.7, 4.5.5
Severity: medium CVSS 5.3
Exploitation: not on CISA KEV · EPSS 0% (39.3th percentile)
Published: 2024-01-16
Source: nvd

References

CWE-862

NVD record eventon (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# PHP projects (recommended)
composer require --dev phpwarden/phpwarden
# then
vendor/bin/phpwarden wordpress /var/www/html

# or, without Composer
pipx install phpwarden   &&   phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2023-2796 medium The EventON WordPress plugin before 2.1.2 lacks authentication and authorization in its ev same package: eventon (WordPress plugin)
CVE-2024-0235 medium The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not ha same package: eventon (WordPress plugin)
CVE-2020-29395 medium The EventON plugin through 3.0.5 for WordPress allows addons/?q= XSS via the search field. same package: eventon (WordPress plugin)
CVE-2023-3219 medium The EventON WordPress plugin before 2.1.2 does not validate that the event_id parameter in same package: eventon (WordPress plugin)
CVE-2023-6158 medium The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable t same package: eventon (WordPress plugin)
CVE-2023-4388 medium The EventON WordPress plugin before 2.2 does not sanitise and escape some of its settings, same package: eventon (WordPress plugin)