CVE-2026-86794highCWE-79

CVE-2026-86794: fallo de gravedad alta en Community Events

Community Events 1.4.9 - 1.5.9 - Unauthenticated Stored XSS via Event Submission Form

Publicada el

Seguir esta CVE+ Monitorear Community Events

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

41Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 8.8epss 0.3%
The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks when processing public event submissions, and does not escape several of the submitted values before outputting them in the administration dashboard and on the public calendar, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of an administrator reviewing the submission.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Productos afectados
Unknown · Community Events
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Community Events

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-24496—Community Event < 1.4.8 - Reflected Cross-Site Scripting (XSS)EPSS 0.8%CVE-2024-6270MEDIUMCommunity Events < 1.5.1 - Admin+ Stored XSSEPSS 0.4%CVE-2024-6271MEDIUMCommunity Events < 1.5 - Event Deletion via CSRFEPSS 0.3%