Access violation vulnerability in EventON (Pro) – WordPress Virtual Event Calendar Plugin 4.9.6

The EventON Pro plugin for WordPress has a security issue that allows someone to change data without permission. This happens because the plugin does not check for the right permissions in one of its files, called ‘assets/lib/settings/settings.js’. This means that if someone with at least Subscriber-level access logs in, they can add harmful code to a page that will run whenever someone visits that page. The problem was fixed somewhat in version 4.9.6.