CVE-2025-3527: EventON - WordPress Virtual Event Calendar Plugin <= 4.9.6 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
The EventON Pro plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'assets/lib/settings/settings.js' file in all versions up to, and including, 4.9.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 4.9.6.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3527?
CVE-2025-3527 has a medium severity rating due to its potential for unauthorized data modification.
How do I fix CVE-2025-3527?
To fix CVE-2025-3527, update the EventON Pro plugin to version 4.9.7 or later.
What versions are affected by CVE-2025-3527?
CVE-2025-3527 affects all versions of the EventON Pro plugin up to and including version 4.9.6.
Who can exploit CVE-2025-3527?
Authenticated attackers with Subscriber-level access can exploit CVE-2025-3527 to modify data.
What is the cause of CVE-2025-3527?
CVE-2025-3527 is caused by a missing capability check in the settings configuration files.