SQL Injection Vulnerability in Community Events Plugin for WordPress
CVE-2025-10587

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Community Events
Vendor
CVE Published:
8 October 2025

What is CVE-2025-10587?

The Community Events plugin for WordPress suffers from an SQL Injection vulnerability due to inadequate escaping of the user-supplied 'event_category' parameter. This issue affects all versions up to and including 1.5.1. Authenticated attackers with Subscriber-level access or higher can exploit this flaw by injecting arbitrary SQL queries into existing database queries. This manipulation can potentially lead to unauthorized access to sensitive information stored in the database.

Affected Version(s)

Community Events * <= 1.5.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/community-even...
https://wordpress.org/plugins/community-events/

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ifoundbug
JSON
.
CVE-2025-10587 : SQL Injection Vulnerability in Community Events Plugin for WordPress