EUVD-2026-75523
GHSA-3vfw-436j-8x6q
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Subscriber auth required (PR:L), victim interaction needed (UI:R), scope changes to admin context (S:C); no direct availability impact from XSS, so A:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Subscriber Cross Site Scripting (XSS) in EventON <= 2.5.7 versions.
AnalysisAI
Stored Cross-Site Scripting in the EventON WordPress plugin (versions ≤ 2.5.7) allows authenticated subscribers to inject malicious JavaScript that executes in the browsers of other users, including administrators. The vulnerability stems from insufficient input sanitization and output encoding in subscriber-accessible event fields, enabling privilege escalation via script execution in a privileged session. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid WordPress subscriber-level account (or higher) on the target site - the CVSS PR:L metric confirms this minimum authentication bar. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 6.5 with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L accurately reflects the authenticated, low-privilege attack origin and the cross-context impact on other users. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update EventON to a version higher than 2.5.7 - the Patchstack advisory references version 2.5.7 as the last vulnerable release, so the fix is expected in the subsequent release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
The EventON plugin through 3.0.5 for WordPress allows addons/?q= XSS via the search field. Rated medium severity (CVSS 6
The EventON WordPress plugin before 2.2.15 does not sanitise and escape some of its settings, which could allow high pri
Unauthenticated SQL injection in the EventON WordPress Virtual Event Calendar plugin (versions through 5.0.11) lets remo
The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX ac
The EventON WordPress plugin before 2.1.2 does not validate that the event_id parameter in its eventon_ics_download ajax
The EventON WordPress plugin before 2.1.2 lacks authentication and authorization in its eventon_ics_download ajax action
The EventON WordPress plugin before 2.2.17 does not sanitise and escape some of its settings, which could allow high pri
The EventON WordPress plugin before 2.2 does not sanitise and escape some of its settings, which could allow high privil
The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to unauthorized modification of
The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery i
The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery i
The EventON Premium WordPress plugin before 4.5.6, EventON WordPress plugin before 2.2.8 do not have authorisation in an
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today