Stored Cross-Site Scripting Vulnerability in Community Events Plugin for WordPress

CVE-2026-1649

What is CVE-2026-1649?

The Community Events plugin for WordPress is exposed to a Stored Cross-Site Scripting vulnerability through the 'ce_venue_name' parameter, impacting all versions up to and including 1.5.7. This weakness arises from inadequate input sanitization and output escaping processes, allowing authenticated users with administrator access to inject malicious scripts. These scripts could execute whenever a user accesses the compromised page, potentially leading to data theft, site defacement, or other malicious activities.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References