Vulnerabilities > Myeventon > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-01-16 | CVE-2024-0238 | Missing Authorization vulnerability in Myeventon Eventon The EventON Premium WordPress plugin before 4.5.6, EventON WordPress plugin before 2.2.8 do not have authorisation in an AJAX action, and does not ensure that the post to be updated belong to the plugin, allowing unauthenticated users to update arbitrary post metadata. | 6.1 |
| 2024-01-11 | CVE-2023-6242 | Cross-Site Request Forgery (CSRF) vulnerability in Myeventon Eventon The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4 (for Pro) & 2.2.7 (for Free). | 4.3 |
| 2024-01-11 | CVE-2023-6244 | Cross-Site Request Forgery (CSRF) vulnerability in Myeventon Eventon The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4 (Pro) & 2.2.8 (Free). | 4.3 |
| 2024-01-10 | CVE-2023-6158 | Missing Authorization vulnerability in Myeventon Eventon The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the evo_eventpost_update_meta function in all versions up to, and including, 4.5.4 (for Pro) and 2.2.7 (for free). | 6.5 |
| 2023-10-21 | CVE-2023-4635 | Cross-site Scripting vulnerability in Myeventon Eventon-Lite The EventON plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping. | 6.1 |
| 2023-10-16 | CVE-2023-4388 | Unspecified vulnerability in Myeventon Eventon The EventON WordPress plugin before 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | 4.8 |
| 2023-07-10 | CVE-2023-2796 | Missing Authorization vulnerability in Myeventon Eventon The EventON WordPress plugin before 2.1.2 lacks authentication and authorization in its eventon_ics_download ajax action, allowing unauthenticated visitors to access private and password protected Events by guessing their numeric id. | 5.3 |
| 2023-07-10 | CVE-2023-3219 | Authorization Bypass Through User-Controlled Key vulnerability in Myeventon Eventon The EventON WordPress plugin before 2.1.2 does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid Event, allowing unauthenticated visitors to access any Post (including unpublished or protected posts) content via the ics export functionality by providing the numeric id of the post. | 5.3 |
| 2020-11-30 | CVE-2020-29395 | Cross-site Scripting vulnerability in Myeventon Eventon The EventON plugin through 3.0.5 for WordPress allows addons/?q= XSS via the search field. | 4.3 |