CVE-2026-9711

Name of the Vulnerable Software and Affected Versions EventON - WordPress Virtual Event Calendar Plugin versions prior to 5.0.12

Description An issue exists where unauthenticated attackers can perform SQL Injection, a technique used to interfere with the queries that an application makes to its database. This occurs via the search parameter due to insufficient escaping of user-supplied input and a lack of preparation in the SQL query. This flaw allows the extraction of sensitive information from the database, provided that the "Enable additional search queries" setting is active and at least one published event exists.

Recommendations Update the plugin to version 5.0.12 or later. Disable the "Enable additional search queries" setting as a temporary mitigation measure.