Community Events: Unauthenticated stored Cross-Site Scripting via event form
Summary
The Community Events WordPress plugin does not check authorisation or nonces on public event submissions and does not escape several submitted values. An unauthenticated attacker can submit an event containing malicious script, which is stored and runs in the browser of an administrator who reviews the submission. Sources conflict on the lower bound of the affected range.
Affected
- Community Events WordPress plugin, versions 1.4.9 to before 1.6.0 (VulDB lists up to 1.5.x; confirm against the WPScan advisory)
Fixed in
- Version 1.6.0 or later (changelog entry: "Fixed potential security issue")
Workaround
- Until patched, restrict access to the event submission form and the admin event pages to trusted users.
- No vendor-documented workaround found; this is a third-party recommendation.
Exploitation
- Not known to be exploited in the wild.
- No public exploit found in Metasploit or Exploit-DB.
- Not listed in CISA KEV. CISA SSVC: exploitation none, automatable no.
Our recommendation
- Identify sites with Community Events installed and check for versions below 1.6.0.
- Update to 1.6.0 or later.
- Until updated, limit access to admin event pages and brief administrators to be cautious with event submissions.
- Recheck the WPScan advisory and NVD once NVD analysis is complete.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan vulnerability record wpscan.com
- Community Events on WordPress.org wordpress.org
- VulDB entry CVE-2026-86794 vuldb.com
- OffSeq Radar threat entry radar.offseq.com
- CVE aggregator entry cve.threatint.com
- GitHub CVE tracker issue github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:23.
Original description (NVD)
The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks when processing public event submissions, and does not escape several of the submitted values before outputting them in the administration dashboard and on the public calendar, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of an administrator reviewing the submission.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.