PT-2025-33465 · WordPress · Eventon Lite

Moose Love + 1 · Published 2025-08-15 · Updated 2025-08-18 · CVE-2025-8091

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: EventON Lite versions prior to 2.4.7

Description: The EventON Lite plugin for WordPress is vulnerable to Information Exposure in versions prior to 2.4.7 via the add single eventon and add eventon shortcodes. Insufficient restrictions on post inclusion allow unauthenticated attackers to extract data from password-protected, private, or draft posts without authorization.

Recommendations: Update EventON Lite to version 2.4.7 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-8091

Affected Products

Eventon Lite

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-8091 · Security Note
• https://plugins.trac.wordpress.org/browser/eventon-lite/trunk/includes/class-evo-shortcodes.php#L32 · Note
• https://wordpress.org/plugins/eventon-lite · Note
• https://plugins.trac.wordpress.org/changeset/3345262 · Note
• https://plugins.trac.wordpress.org/browser/eventon-lite/trunk/includes/class-event.php#L39 · Note
• https://t.me/CVEtracker/30110 · Telegram Post
• https://plugins.trac.wordpress.org/browser/eventon-lite/trunk/includes/class-evo-shortcodes.php#L81 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/421fcee2-a05d-4486-837e-ddee3d73d737?source=cve · Note
• https://reddit.com/r/CVEWatch/comments/1mtht6n/top_10_trending_cves_18082025 · Reddit Post
• https://twitter.com/VulmonFeeds/status/1956304777987453261 · Twitter Post
• https://plugins.trac.wordpress.org/browser/eventon-lite/trunk/includes/calendar/class-calendar_generator.php#L954 · Note
• https://twitter.com/CVEnew/status/1956289015159906475 · Twitter Post