Stored Cross-Site Scripting in Community Events Plugin for WordPress

CVE-2025-11995

What is CVE-2025-11995?

The Community Events plugin for WordPress contains a vulnerability that allows for Stored Cross-Site Scripting. This issue arises from inadequate input sanitization and output escaping in the event details parameter. An unauthenticated attacker can exploit this vulnerability to inject malicious web scripts into event pages, which will execute when a user accesses the compromised page. Users of the plugin should ensure their versions are updated to mitigate the risk of exploitation.

References