EventON, CVE-2024-6180

CVE, Research URL: CVE-2024-6180
Home page URL: Security reports for EventON
Application: EventON
Published on: Jul 09, 2024
Research Description: The EventON plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'eventon_import_settings' ajax action in all versions up to, and including, 2.2.15. This makes it possible for unauthenticated attackers to update plugin settings, including adding stored cross-site scripting to settings options displayed on event calendar pages.
Affected versions: Min -, max 2.2.15.
Status: vulnerable