What the vulnerability does
01Description
The EventON Pro plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'assets/lib/settings/settings.js' file in all versions up to, and including, 4.9.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 4.9.6.
Explanation of Vulnerability in Simple Terms
02Summary
EventON Pro versions up to 4.9.6 lack proper authorization checks on certain administrative functions. A logged-in user with low privileges can access or modify data they should not have permission to view or change. The vulnerability affects the scope beyond the plugin itself, potentially impacting other site components. Update to a version newer than 4.9.6.
What an attacker can do
03Attacker Capabilities
Access or modify event data and settings without proper authorization.
Potential impact on your site
04Site Impact
Unauthorized users can view or alter event information, potentially disrupting calendar functionality or exposing sensitive event details.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
06Disclosure timeline
May 17, 2025
CVE published
April 8, 2026
Record updated
