EventON – Events Calendar

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

271 searches this plugin appeared in over the last 90 days, 20 listed. 207 left out as unrelated or noise (years, numbers, stray words).

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 69% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 20 months ago; a band this size takes about a year or more to cross, which places it about 90% of the way through.

1. ★★★★★ fionarey

   6mo ago

   I had a problem with eventon lite after an update and the support was super fast and kind. The Problem got solved right away with the next update.As we only use eventon lite I can’t rate eventOn, the price structure doesn’t really work for us.

   Read on wp.org ↗
2. ★★★★★ elecuyer

   8mo ago

   We use EventOn Lite as a calendar-only in conjunction with a ticketing platform. It works reasonably well and EventOn is always adding new features and fixes. One recent upgrade however broke the linking function we rely upon. A posting at the wordpress/eventon-lite support forum got prompt attention and a quick fix was provided.

   Read on wp.org ↗
3. ★★★★★ RussWilley

   8mo ago

   A good events calendar plugin is hard to find, so I was delighted to discover EventON, which meets all my needs and has plenty of options. And if you should ever need help, the support is excellent. This topic was modified 4 months, 1 week ago by RussWilley.

   Read on wp.org ↗
4. ★★★★★ JHWas

   9mo ago

   Using it since years. Now we were missing an option to hide “change RSVP” and the EventOn team implemented it in the next release within 2 weeks. Great, thank you for always beeing on our side for years.

   Read on wp.org ↗
5. ★★★★★ picowordpressorg

   9mo ago

   I had problems switching to a newer PHP version. The answers came quickly and helped everything run smoothly again.

   Read on wp.org ↗
6. ★★★★★ cyrielle9

   11mo ago

   I’m working with EventOn since 2012 and had now in end of 2025 first time a little bug. The support helped at once 🙂 I highly recommend it.

   Read on wp.org ↗
7. ★★★★★ suzbinky

   1.1y ago

   Torn. The plugin itself it cool. Worked well. What we hadn’t counted on was how invsaive it was to rewrite so much custom javascript we had. First, I hadn’t noticed the toggle for the map feature. That botched up a custom map display we had. Toggle resolved it. Easy peasy – support was great helping us quickly troubleshoot that. BUT we have a custom application process with dozens of fields related to licenses, etc. TOTALLY unrelated to the plugin. It stripped out all of their data in about 10 fields – gone. We had to track down the conflicting javascript, rewrite ours and manually re-enter the missing data in the php my admin. Yes, I know, should have used a testing sandbox with a duplicate of the site. The map piece was one thing. We would have never thought it would affect something completely unrelated to the plugin. It’s a cautionary tale. You may not think it will affect your site – especially if you have customizations, but think again.

   Read on wp.org ↗
8. ★★★★★ vellebelle

   1.3y ago

   I strongly advise you not to buy the paid version of this plugin – or any of the addons for that matter. There are far better alternatives out there, and using this one has been nothing but a headache for us. The team behind it is extremely unprofessional, and the plugin itself is maintained by only one developer – something their own support staff confirmed to me. That alone makes it a huge risk. If that one developer stops maintaining it or simply disappears, your site is left vulnerable. Speaking of vulnerabilities, there was a serious security issue reported on PatchStack, and they failed to release a fix until it was far too late. Because of that, several of our sites were hacked and our hosting company had to take them offline. This level of negligence is completely unacceptable for a commercial plugin. Support is another disaster. Every time you reach out for help, you get the same canned response: “I will assign this ticket to Ashan,” (the sole developer) and then you wait days or even a week before hearing anything back. When you finally do get a reply, it’s rarely helpful and often just another delay. I even remember several times when they sent me a “patch” fix for something, not as actual code or files, but as a screenshot. A screenshot of code that I then had to manually re‑type line by line. That level of unprofessionalism speaks for itself. On top of that, the whole update process is outdated and clunky. You cannot update the addon plugins directly from your WordPress dashboard. Instead, you have to manually download and reinstall them every single time there’s an update. The code quality is a mess as well. It is full of bugs and uses your server’s resources in ways that make no sense. For instance, deleting an event with attached tickets can take up to a full minute, even on a powerful server, and sometimes it will time out completely. Watching your server grind to a halt over something so basic is infuriating. We’ve used this plugin across several client sites and have regretted it every single time. After repeated issues, we’ve finally decided to migrate all of those sites to a better, more reliable system. In my opinion, it shouldn’t even be legal to sell software of this quality. Save yourself the frustration, the security risks, and the wasted time. Stay far away from this plugin.

   Read on wp.org ↗

Recent releases and news for this plugin

1. 2026-10-29 Version 2.5.11 FIXED: unable to remove styles FIXED: XSS vulnerability with language var 2.5.11
2. — Version 2.5.5 FIXED: timezone dropdown not working FIXED: Event type x templates not loading 2.5.5
3. — Version 2.5.4 FIXED: get direction translation text FIXED: custom meta not showing in eventtop unless event tags are enabled UPDATED: Handlebar js to latest version 4.7.8 2.5.4
4. — Version 2.5.3 FIXED: undefined index on custom repeats FIXED: custom repeats not getting added FIXED: month jumper not working UPDATED: Custom repeats UI 2.5.3
5. — Version 2.5.2 FIXED: undefined IMG error on event pages 2.5.2
6. — Version 2.5.1 FIXED: event click external link not working FIXED: undefined image background error FIXED: XSS issue with eventon settings page tab values passed via url FIXED: Settings tooltip on collapsed menu icons 2.5.1

All 22 disclosed vulnerabilities are patched in the current version (2.5.11). Sites still on an older version should update.

1. Patched Medium · 6.4 EventON – Events Calendar <= 2.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting ↗
   2026-09-08 CVE-2026-81791 Improper Neutralization of Input During Web Page Generation Affects <= 2.5.7 Patched in 2.5.8
2. Patched Medium · 4.3 EventON Lite <= 2.4.7 - Authenticated (Contributor+) Information Disclosure ↗
   2025-08-14 CVE-2025-8091 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 2.4.7 Patched in 2.4.8
3. Patched Medium · 5.3 EventON <= 2.4.4 - Missing Authorization ↗
   2025-05-16 CVE-2025-48116 Missing Authorization Affects <= 2.4.4 Patched in 2.4.5
4. Patched High · 8.8 EventON <= 2.4.1 - Authenticated (Contributor+) Local File Inclusion ↗
   2025-05-07 CVE-2025-47494 Improper Control of Filename for Include/Require Statement in PHP Program Affects <= 2.4.1 Patched in 2.4.2
5. Patched Critical · 9.8 EventON <= 2.4 - Unauthenticated Local File Inclusion ↗
   2025-04-09 CVE-2025-32614 Improper Control of Filename for Include/Require Statement in PHP Program Affects <= 2.4 Patched in 2.4.1
6. Patched High · 8.8 EventON <= 2.4.1 - Authenticated (Contributor+) Local File Inclusion ↗
   2025-04-04 CVE-2025-32160 Improper Control of Filename for Include/Require Statement in PHP Program Affects <= 2.4.1 Patched in 2.4.2
7. Patched Medium · 4.4 EventON <= 2.2.16 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
   2024-08-19 CVE-2024-6910 Improper Neutralization of Input During Web Page Generation Affects <= 2.2.16 Patched in 2.2.17
8. Patched High · 7.2 EventON <= 2.2.15 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting and Plugin Settings Updates ↗
   2024-07-08 CVE-2024-6180 Missing Authorization Affects <= 2.2.15 Patched in 2.2.16
9. Patched Medium · 4.4 EventON <= 2.2.14 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
   2024-04-30 CVE-2024-33940 Improper Neutralization of Input During Web Page Generation Affects <= 2.2.14 Patched in 2.2.15
10. Patched Medium · 5.3 EventON - WordPress Virtual Event Calendar Plugin <= 4.5.8 (Pro) & <= 2.2.7 (Free) - Missing Authorization via eventon_save_virtual_event_settings ↗
    2024-01-10 CVE-2024-0237 Missing Authorization Affects <= 2.2.7 Patched in 2.2.8
11. Patched Medium · 6.1 EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.7 (Free) - Reflected Cross-Site Scripting ↗
    2024-01-10 CVE-2024-0233 Improper Neutralization of Input During Web Page Generation Affects <= 2.2.7 Patched in 2.2.8
12. Patched Medium · 5.3 EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.7 (Free) - Missing Authorization via config_virtual_event ↗
    2024-01-10 CVE-2024-0236 Missing Authorization Affects <= 2.2.7 Patched in 2.2.8
13. Patched Medium · 5.3 EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.7 (Free) - Missing Authorization via get_virtual_users ↗
    2024-01-10 CVE-2024-0235 Missing Authorization Affects <= 2.2.7 Patched in 2.2.8
14. Patched Medium · 4.4 EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.7 (Free) - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2024-01-10 CVE-2023-6005 Improper Neutralization of Input During Web Page Generation Affects <= 2.2.7 Patched in 2.2.8
15. Patched Medium · 6.5 EventON - WordPress Virtual Event Calendar Plugin Pro <= 4.5.4 & Free <= 2.2.7 - Missing Authorization to Arbitrary Post Meta Update via evo_eventpost_update_meta ↗
    2024-01-09 CVE-2023-6158 Missing Authorization Affects <= 2.2.7 Patched in 2.2.8
16. Patched Medium · 6.5 EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.8 (Free) - Cross-Site Request Forgery via save_virtual_event_settings ↗
    2024-01-09 CVE-2023-6244 Cross-Site Request Forgery Affects <= 2.2.8 Patched in 2.2.9
17. Patched Medium · 6.5 EventON - WordPress Virtual Event Calendar Plugin Pro <= 4.5.4 & Free <= 2.2.7 - Cross-Site Request Forgery via evo_eventpost_update_meta ↗
    2024-01-09 CVE-2023-6242 Cross-Site Request Forgery Affects <= 2.2.7 Patched in 2.2.8
18. Patched Low · 3.0 EventON <= 2.1.7 - Authenticated (Admin+) HTML Injection ↗
    2023-11-09 CVE-2023-6046 Improper Neutralization of Input During Web Page Generation Affects <= 2.1.7 Patched in 2.2
19. Patched Medium · 6.1 EventON <= 2.2.2 - Reflected Cross-Site Scripting ↗
    2023-10-20 CVE-2023-4635 Improper Neutralization of Input During Web Page Generation Affects <= 2.2.2 Patched in 2.2.3
20. Patched Medium · 4.4 EventON <= 2.1.7 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2023-09-21 CVE-2023-4388 Improper Neutralization of Input During Web Page Generation Affects <= 2.1.7 Patched in 2.2
21. Patched High · 7.5 EventON <= 2.1 - Insecure Direct Object Reference to Unauthorized Post Access ↗
    2023-06-19 CVE-2023-3219 Authorization Bypass Through User-Controlled Key Affects <= 2.1 Patched in 2.1.2
22. Patched Medium · 5.3 EventON <= 2.1 - Missing Authorization to Event Access ↗
    2023-06-19 CVE-2023-2796 Missing Authorization Affects <= 2.1 Patched in 2.1.2

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 9 languages, 0 at 90% or more

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Not measured yet for this plugin’s topics. Its tracked searches are not among the measured topics. See the topics measured so far.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2025-03-25 5K+ → 6K+ up after 299 days in tier
2. 2024-05-30 4K+ → 5K+ up after 1 days in tier
3. 2024-05-29 5K+ → 4K+ down after 1 days in tier
4. 2024-05-28 4K+ → 5K+ up after 227 days in tier
5. 2023-10-14 3K+ → 4K+ up after 200 days in tier
6. 2023-03-28 2K+ → 3K+ up after 139 days in tier
7. 2022-11-09 1K+ → 2K+ up after 36 days in tier
8. 2022-10-04 500+ → 1K+ up

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for EventON – Events Calendar into a readme, a review or a deck. It updates itself.

EventON – Events Calendar: 6K+ active installs, 4.1★ (44 reviews). Plugin Pulse (WP Mayor), as of 2026-10-31. https://plugins.wpmayor.com/plugin/eventon-lite