CVE-2024-6180 is a missing authorization vulnerability (CWE-862) in the EventON – Events Calendar WordPress plugin by ashanjay. The issue arises because the 'eventon_import_settings' AJAX action does not verify user capabilities, allowing unauthenticated attackers to update plugin settings. This can result in stored cross-site scripting (XSS) attacks via settings options displayed on event calendar pages. The vulnerability affects all versions up to and including 2.2.15. No official patch or vendor advisory is currently provided, and no known exploits are reported in the wild.

An attacker can modify plugin settings without authentication, potentially injecting stored XSS payloads that execute in the context of users viewing event calendar pages. This can lead to information disclosure and user session compromise. The vulnerability does not impact availability but affects confidentiality and integrity of the affected WordPress sites using this plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the AJAX action if possible or disable the plugin to prevent exploitation. Monitor for updates from the plugin vendor and apply patches promptly once available.