EventON – Events Calendar

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 69% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

A small install base leaves thin data to model from. The recent download trend is too spiky to read. The range spans more than 10x because wp.org publishes install counts as broad bands, and conversion and price compound on top. Read the midpoint as an order of magnitude, not a valuation.

1. ★★★★★ fionarey

   4mo ago

   I had a problem with eventon lite after an update and the support was super fast and kind. The Problem got solved right away with the next update.As we only use eventon lite I can’t rate eventOn, the price structure doesn’t really work for us.

   Read on wp.org ↗
2. ★★★★★ elecuyer

   6mo ago

   We use EventOn Lite as a calendar-only in conjunction with a ticketing platform. It works reasonably well and EventOn is always adding new features and fixes. One recent upgrade however broke the linking function we rely upon. A posting at the wordpress/eventon-lite support forum got prompt attention and a quick fix was provided.

   Read on wp.org ↗
3. ★★★★★ RussWilley

   6mo ago

   A good events calendar plugin is hard to find, so I was delighted to discover EventON, which meets all my needs and has plenty of options. And if you should ever need help, the support is excellent. This topic was modified 4 months, 1 week ago by RussWilley.

   Read on wp.org ↗
4. ★★★★★ JHWas

   6mo ago

   Using it since years. Now we were missing an option to hide “change RSVP” and the EventOn team implemented it in the next release within 2 weeks. Great, thank you for always beeing on our side for years.

   Read on wp.org ↗
5. ★★★★★ picowordpressorg

   7mo ago

   I had problems switching to a newer PHP version. The answers came quickly and helped everything run smoothly again.

   Read on wp.org ↗
6. ★★★★★ cyrielle9

   9mo ago

   I’m working with EventOn since 2012 and had now in end of 2025 first time a little bug. The support helped at once 🙂 I highly recommend it.

   Read on wp.org ↗
7. ★★★★★ suzbinky

   12mo ago

   Torn. The plugin itself it cool. Worked well. What we hadn’t counted on was how invsaive it was to rewrite so much custom javascript we had. First, I hadn’t noticed the toggle for the map feature. That botched up a custom map display we had. Toggle resolved it. Easy peasy – support was great helping us quickly troubleshoot that. BUT we have a custom application process with dozens of fields related to licenses, etc. TOTALLY unrelated to the plugin. It stripped out all of their data in about 10 fields – gone. We had to track down the conflicting javascript, rewrite ours and manually re-enter the missing data in the php my admin. Yes, I know, should have used a testing sandbox with a duplicate of the site. The map piece was one thing. We would have never thought it would affect something completely unrelated to the plugin. It’s a cautionary tale. You may not think it will affect your site – especially if you have customizations, but think again.

   Read on wp.org ↗
8. ★★★★★ vellebelle

   1.1y ago

   I strongly advise you not to buy the paid version of this plugin – or any of the addons for that matter. There are far better alternatives out there, and using this one has been nothing but a headache for us. The team behind it is extremely unprofessional, and the plugin itself is maintained by only one developer – something their own support staff confirmed to me. That alone makes it a huge risk. If that one developer stops maintaining it or simply disappears, your site is left vulnerable. Speaking of vulnerabilities, there was a serious security issue reported on PatchStack, and they failed to release a fix until it was far too late. Because of that, several of our sites were hacked and our hosting company had to take them offline. This level of negligence is completely unacceptable for a commercial plugin. Support is another disaster. Every time you reach out for help, you get the same canned response: “I will assign this ticket to Ashan,” (the sole developer) and then you wait days or even a week before hearing anything back. When you finally do get a reply, it’s rarely helpful and often just another delay. I even remember several times when they sent me a “patch” fix for something, not as actual code or files, but as a screenshot. A screenshot of code that I then had to manually re‑type line by line. That level of unprofessionalism speaks for itself. On top of that, the whole update process is outdated and clunky. You cannot update the addon plugins directly from your WordPress dashboard. Instead, you have to manually download and reinstall them every single time there’s an update. The code quality is a mess as well. It is full of bugs and uses your server’s resources in ways that make no sense. For instance, deleting an event with attached tickets can take up to a full minute, even on a powerful server, and sometimes it will time out completely. Watching your server grind to a halt over something so basic is infuriating. We’ve used this plugin across several client sites and have regretted it every single time. After repeated issues, we’ve finally decided to migrate all of those sites to a better, more reliable system. In my opinion, it shouldn’t even be legal to sell software of this quality. Save yourself the frustration, the security risks, and the wasted time. Stay far away from this plugin.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 2.5.5 FIXED: timezone dropdown not working FIXED: Event type x templates not loading 2.5.5
2. — Version 2.5.4 FIXED: get direction translation text FIXED: custom meta not showing in eventtop unless event tags are enabled UPDATED: Handlebar js to latest version 4.7.8 2.5.4
3. — Version 2.5.3 FIXED: undefined index on custom repeats FIXED: custom repeats not getting added FIXED: month jumper not working UPDATED: Custom repeats UI 2.5.3
4. — Version 2.5.2 FIXED: undefined IMG error on event pages 2.5.2
5. — Version 2.5.1 FIXED: event click external link not working FIXED: undefined image background error FIXED: XSS issue with eventon settings page tab values passed via url FIXED: Settings tooltip on collapsed menu icons 2.5.1
6. — Version 2.5 ADDED: get direction to have event destination address with option to copy ADDED: option to open event map as expanded full page ADDED: subtitle column for events in wp-admin ADDED: the option to show duration of the eve 2.5

21 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Medium · 4.3 EventON Lite <= 2.4.7 - Authenticated (Contributor+) Information Disclosure ↗
   2025-08-14 CVE-2025-8091 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 2.4.7 Patched in 2.4.8
2. Medium · 5.3 EventON <= 2.4.4 - Missing Authorization ↗
   2025-05-16 CVE-2025-48116 Missing Authorization Affects <= 2.4.4 Patched in 2.4.5
3. High · 8.8 EventON <= 2.4.1 - Authenticated (Contributor+) Local File Inclusion ↗
   2025-05-07 CVE-2025-47494 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') Affects <= 2.4.1 Patched in 2.4.2
4. Critical · 9.8 EventON <= 2.4 - Unauthenticated Local File Inclusion ↗
   2025-04-09 CVE-2025-32614 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') Affects <= 2.4 Patched in 2.4.1
5. High · 8.8 EventON <= 2.4.1 - Authenticated (Contributor+) Local File Inclusion ↗
   2025-04-04 CVE-2025-32160 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') Affects <= 2.4.1 Patched in 2.4.2
6. Medium · 4.4 EventON <= 2.2.16 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
   2024-08-19 CVE-2024-6910 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.2.16 Patched in 2.2.17
7. High · 7.2 EventON <= 2.2.15 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting and Plugin Settings Updates ↗
   2024-07-08 CVE-2024-6180 Missing Authorization Affects <= 2.2.15 Patched in 2.2.16
8. Medium · 4.4 EventON <= 2.2.14 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
   2024-04-30 CVE-2024-33940 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.2.14 Patched in 2.2.15
9. Medium · 5.3 EventON - WordPress Virtual Event Calendar Plugin <= 4.5.8 (Pro) & <= 2.2.7 (Free) - Missing Authorization via eventon_save_virtual_event_settings ↗
   2024-01-10 CVE-2024-0237 Missing Authorization Affects <= 2.2.7 Patched in 2.2.8
10. Medium · 6.1 EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.7 (Free) - Reflected Cross-Site Scripting ↗
    2024-01-10 CVE-2024-0233 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.2.7 Patched in 2.2.8
11. Medium · 5.3 EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.7 (Free) - Missing Authorization via config_virtual_event ↗
    2024-01-10 CVE-2024-0236 Missing Authorization Affects <= 2.2.7 Patched in 2.2.8
12. Medium · 5.3 EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.7 (Free) - Missing Authorization via get_virtual_users ↗
    2024-01-10 CVE-2024-0235 Missing Authorization Affects <= 2.2.7 Patched in 2.2.8
13. Medium · 4.4 EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.7 (Free) - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2024-01-10 CVE-2023-6005 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.2.7 Patched in 2.2.8
14. Medium · 6.5 EventON - WordPress Virtual Event Calendar Plugin Pro <= 4.5.4 & Free <= 2.2.7 - Missing Authorization to Arbitrary Post Meta Update via evo_eventpost_update_meta ↗
    2024-01-09 CVE-2023-6158 Missing Authorization Affects <= 2.2.7 Patched in 2.2.8
15. Medium · 6.5 EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.8 (Free) - Cross-Site Request Forgery via save_virtual_event_settings ↗
    2024-01-09 CVE-2023-6244 Cross-Site Request Forgery (CSRF) Affects <= 2.2.8 Patched in 2.2.9
16. Medium · 6.5 EventON - WordPress Virtual Event Calendar Plugin Pro <= 4.5.4 & Free <= 2.2.7 - Cross-Site Request Forgery via evo_eventpost_update_meta ↗
    2024-01-09 CVE-2023-6242 Cross-Site Request Forgery (CSRF) Affects <= 2.2.7 Patched in 2.2.8
17. Low · 3.0 EventON <= 2.1.7 - Authenticated (Admin+) HTML Injection ↗
    2023-11-09 CVE-2023-6046 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.1.7 Patched in 2.2
18. Medium · 6.1 EventON <= 2.2.2 - Reflected Cross-Site Scripting ↗
    2023-10-20 CVE-2023-4635 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.2.2 Patched in 2.2.3
19. Medium · 4.4 EventON <= 2.1.7 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2023-09-21 CVE-2023-4388 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.1.7 Patched in 2.2
20. High · 7.5 EventON <= 2.1 - Insecure Direct Object Reference to Unauthorized Post Access ↗
    2023-06-19 CVE-2023-3219 Authorization Bypass Through User-Controlled Key Affects <= 2.1 Patched in 2.1.2
21. Medium · 5.3 EventON <= 2.1 - Missing Authorization to Event Access ↗
    2023-06-19 CVE-2023-2796 Missing Authorization Affects <= 2.1 Patched in 2.1.2

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 8 languages, 0 at 90% or more

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2025-03-25 5K+ → 6K+ up after 299 days in tier
2. 2024-05-30 4K+ → 5K+ up after 1 days in tier
3. 2024-05-29 5K+ → 4K+ down after 1 days in tier
4. 2024-05-28 4K+ → 5K+ up after 227 days in tier
5. 2023-10-14 3K+ → 4K+ up after 200 days in tier
6. 2023-03-28 2K+ → 3K+ up after 139 days in tier
7. 2022-11-09 1K+ → 2K+ up

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• Sugar Calendar – Events Calendar, Event Tickets, and Events Management Platform 10K+ installs · 4.3★ · 4 shared tags A
• Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce 10K+ installs · 4.6★ · 3 shared tags A
• Event Calendar – Calendar 2K+ installs · 4.6★ · 3 shared tags B
• Tockify Events Calendar 2K+ installs · 4.3★ · 3 shared tags A
• Quick Event Manager 1K+ installs · 4.7★ · 3 shared tags B
• Event Genius – Event Management, Events Calendar, Registration, and RSVP 600+ installs · 4.3★ · 3 shared tags A

Embed this report card

Drop a live Pulse card for EventON – Events Calendar into a readme, a review or a deck. It updates itself.

EventON – Events Calendar: 6K+ active installs, 4.1★ (44 reviews). Plugin Pulse (WP Mayor), as of 2026-08-30. https://plugins.wpmayor.com/plugin/eventon-lite