Unauthorized Data Modification in EventON Plugin for WordPress

CVE-2024-6180

What is CVE-2024-6180?

The EventON plugin for WordPress is susceptible to unauthorized data manipulation due to inadequate capability validation in the 'eventon_import_settings' AJAX action. This security lapse allows unauthenticated attackers to alter plugin settings, potentially inserting stored cross-site scripting (XSS) payloads into settings options that appear on event calendar pages. Awareness of this vulnerability is crucial for site administrators utilizing affected versions, as it poses risks of exploitation that could compromise the integrity of event-related data.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References