CVE-2026-9711
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk35th percentile — higher than 35% of all known CVEs
Summary
The EventON plugin for WordPress up to version 5.0.11 is vulnerable to SQL injection via the 'search' parameter. Insufficient escaping and lack of query preparation allow unauthenticated attackers to append additional SQL queries, enabling extraction of sensitive database information if the 'Enable additional search queries' setting is enabled and at least one published event exists.
Risk Assessment
The risk involves potential theft of sensitive data from the WordPress database, such as user passwords or configuration details, by an unauthenticated attacker, which could lead to full site compromise.
Recommendation
Immediately update the EventON plugin to the latest available version that fixes this vulnerability. If an update is not possible, temporarily disable the 'Enable additional search queries' setting and remove any unnecessary published events.
Original NVD description (English source)
The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress (full) is vulnerable to SQL Injection via the WordPress 'search' parameter in versions up to, and including, 5.0.11 due to insufficient escaping on the user supplied parameter and lack of preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database, granted the "Enable additional search queries" setting is enabled and at least one published event exists.