The EventON Pro WordPress Virtual Event Calendar plugin suffers from a missing authorization check (CWE-862) in its JavaScript settings file, allowing authenticated users with low privileges (Subscriber and above) to inject arbitrary scripts into pages. This vulnerability affects all versions up to and including 4.9.6. Although version 4.9.6 includes a partial patch, a complete fix has not been confirmed. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting a medium severity with network attack vector, low attack complexity, and no user interaction required. The impact includes potential confidentiality and integrity loss through script injection. No known public exploits exist currently.

An attacker with Subscriber-level access or higher can inject arbitrary web scripts into pages, which execute when users access those pages. This can lead to unauthorized modification of data and potential confidentiality and integrity impacts. There is no indication of availability impact. The vulnerability is rated medium severity with a CVSS score of 6.4. No known exploits are reported in the wild.

The vulnerability was partially patched in version 4.9.6 of the EventON Pro plugin. However, no full patch or official fix is confirmed at this time. Users should monitor the vendor's advisory for updates and apply any forthcoming official patches promptly. Until a complete fix is available, restrict plugin access to trusted users only and consider additional monitoring of affected pages for suspicious script activity.