CVE-2026-81791
MediumCVSS 6.5Summary
Subscriber Cross Site Scripting (XSS) in EventON <= 2.5.7 versions.
Risk Assessment
A low-privileged user can inject scripts that execute in other users' browsers, leading to session theft or phishing.
Recommendation
Update the EventON plugin to a version later than 2.5.7.
Other vulnerabilities in EventON
See all- CVE-2026-9711Critical
The EventON plugin for WordPress up to version 5.0.11 is vulnerable to SQL injection via the 'search' parameter. Insufficient escaping and lack of query preparation allow unauthenticated attackers to append additional SQL queries, enabling extraction of sensitive database information if the 'Enable additional search queries' setting is enabled and at least one published event exists.
- CVE-2025-63064Medium
The EventON plugin (versions up to and including 4.9.12) contains a Stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. A malicious script can be persistently stored and executed in the user's browser.
Original NVD description (English source)
Subscriber Cross Site Scripting (XSS) in EventON <= 2.5.7 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS