CVE-2026-86794: Community Events 1.4.9 - 1.5.9 - Unauthenticated Stored XSS via Event Submission Form
The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks when processing public event submissions, and does not escape several of the submitted values before outputting them in the administration dashboard and on the public calendar, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of an administrator reviewing the submission.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Community Events versions before 1.6.0 are affected. The vulnerable functionality is the public event-submission workflow, which processes submissions without authorization or nonce checks.
What does an attacker need to exploit the vulnerability?
An attacker can submit a crafted event through the public submission form without authentication. The injected script executes when an administrator reviews the submission, and vulnerable values may also be output on the public calendar.
How can I tell whether an installation may already be affected?
Review event submissions and displayed event content for unexpected HTML or script payloads, particularly submissions made through the public form. Check whether the installed Community Events version is earlier than 1.6.0.
What should be done if an immediate update is not possible?
Restrict or disable public event submissions until the plugin can be updated, and carefully review existing submissions before viewing them in an administrator browser. Remove suspicious submitted content that could contain script payloads.