https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-3527.htmlhttps://patchthecve.com/cve/CVE-2025-3527.htmlWed, 17 Jun 2026 09:20:06 +0000MEDIUM 6.4: The EventON Pro plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'assets/lib/settings/settings.js' file in all versions up to, and including, 4.9.6. This makes it possible for authenticated attackers, with Subscriber-level access and abhttps://patchthecve.com/cve/CVE-2023-6243.htmlhttps://patchthecve.com/cve/CVE-2023-6243.htmlWed, 17 Jun 2026 06:50:22 +0000MEDIUM 4.3: The EventON PRO - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6.8. This is due to missing or incorrect nonce validation on the admin_test_email function. This makes it possible for unauthenticated athttps://patchthecve.com/cve/CVE-2024-6910.htmlhttps://patchthecve.com/cve/CVE-2024-6910.htmlWed, 17 Jun 2026 08:18:57 +0000MEDIUM 4.8: The EventON WordPress plugin before 2.2.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.https://patchthecve.com/cve/CVE-2024-4752.htmlhttps://patchthecve.com/cve/CVE-2024-4752.htmlWed, 17 Jun 2026 08:02:33 +0000MEDIUM 5.9: The EventON WordPress plugin before 2.2.15 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)