Stored Cross-Site Scripting in Community Events Plugin for WordPress

CVE-2025-11995

What is CVE-2025-11995?

The Community Events plugin for WordPress contains a vulnerability that allows for Stored Cross-Site Scripting. This issue arises from inadequate input sanitization and output escaping in the event details parameter. An unauthenticated attacker can exploit this vulnerability to inject malicious web scripts into event pages, which will execute when a user accesses the compromised page. Users of the plugin should ensure their versions are updated to mitigate the risk of exploitation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References