CVE-2023-4635 — Cross-site Scripting in Eventon Events Calendar

CWE-79 — Cross-site Scripting4 documents4 sources
Severity
6.1MEDIUMNVD
EPSS
1.6%
top 18.18%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Ashanjay Eventon Events CalendarMyeventon Eventon-lite
Timeline
PublishedOct 21
Latest updateApr 10

Description

The EventON plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

🔴Vulnerability Details

3
VulDB
EventON Plugin up to 2.2.2 on WordPress cross site scripting↗2026-04-10
▶
GHSA
GHSA-836w-q8xf-8mq9: The EventON plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in versions up to, and including, 2↗2023-10-21
▶
CVEList
EventON <= 2.2.2 - Reflected Cross-Site Scripting↗2023-10-21
▶
CVE-2023-4635 — Cross-site Scripting | cvebase