Stored Cross-Site Scripting Vulnerability in Community Events Plugin for WordPress

CVE-2026-1649

What is CVE-2026-1649?

The Community Events plugin for WordPress is exposed to a Stored Cross-Site Scripting vulnerability through the 'ce_venue_name' parameter, impacting all versions up to and including 1.5.7. This weakness arises from inadequate input sanitization and output escaping processes, allowing authenticated users with administrator access to inject malicious scripts. These scripts could execute whenever a user accesses the compromised page, potentially leading to data theft, site defacement, or other malicious activities.

References