Community Events

Community Events has 12 disclosed vulnerabilities in the WordSec catalog, reported between 2015 and 2026; all 12 are fixed as of September 2026. Their average CVSS score is 6.6, and the most serious one scores 9.8 out of 10. Severity breakdown: 3 critical and 2 high. 2025 was the busiest year with 4 disclosures.

The most common weakness is Cross-Site Scripting, behind 5 of the records (42%). Other recurring categories include SQL Injection, Cross-Site Request Forgery (CSRF).

Every one of the 12 issues recorded for Community Events has a vendor fix available, so running the current release closes all known holes.

8 independent researchers contributed these findings, most of them (3) reported by ifoundbug. Community Events is installed on roughly 30 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.

Strategic Overview

Avg CVSSMedium

6.6/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Community Events vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2025-10586

Community Events <= 1.5.1 - Unauthenticated SQL Injection

Read the full analysis

Vulnerability Records

12 records


2026-03-06 11:49	Community Events <= 1.5.8 - Authenticated (Administrator+) SQL Injection via 'ce_venue_name' CSV Field Community Events <= 1.5.8	`CVE-2026-2429`	4.9 Medium	Bee	Yes
2026-02-17 20:16	Community Events <= 1.5.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'ce_venue_name' Parameter Community Events <= 1.5.7	`CVE-2026-1649`	4.4 Medium	Bee	Yes
2026-01-16 15:39	Community Events <= 1.5.6 - Missing Authorization to Unauthenticated Arbitrary Event Approval via 'eventlist' Parameter Community Events <= 1.5.6	`CVE-2025-14029`	5.3 Medium	Itthidej Aramsri (Boeing777)	Yes
2025-11-18 17:29	Community Events <= 1.5.4 - Unauthenticated SQL Injection Community Events <= 1.5.4	`CVE-2025-12646`	7.5 High	Muhammad Yudha - DJ	Yes
2025-10-31 16:03	Community Events <= 1.5.2 - Unauthenticated Stored Cross-Site Scripting Community Events <= 1.5.2	`CVE-2025-11995`	7.2 High	ifoundbug	Yes
2025-10-08 13:32	Community Events <= 1.5.1 - Unauthenticated SQL Injection Community Events <= 1.5.1	`CVE-2025-10586`	9.8 Critical	ifoundbug	Yes
2025-10-07 14:36	Community Events <= 1.5.1 - Unauthenticated SQL Injection Community Events <= 1.5.1	`CVE-2025-10587`	9.8 Critical	ifoundbug	Yes
2024-07-15 00:00	Community Events <= 1.5 - Authenticated (Admin+) Stored Cross-Site Scripting Community Events <= 1.5	`CVE-2024-6270`	4.4 Medium	Bob Matyas	Yes
2024-07-01 00:00	Community Events <= 1.4.9 - Cross-Site Request Forgery Community Events <= 1.4.9	`CVE-2024-6271`	4.3 Medium	Bob Matyas	Yes
2022-11-25 00:00	Community Events <= 1.4.8 - Authenticated (Administrator+) Stored Cross Site Scripting Community Events <= 1.4.8	`CVE-2022-44742`	5.5 Medium	sk4rl1ghT	Yes

Showing 1–10 of 12 reports

Latestv1.5.9

Community Events

Author

Yannick Lefebvre

3.0(2)

60/100

Last Updated

2026-02-15 (7mo ago)

Active Installs

30+

Downloads

19,679

Requires WP

3.0+

Requires PHP

Tested up to

WP 6.9.7

Created

2010-07-15 (16y ago)

The purpose of this plugin is to allow users to create a schedule of upcoming events and display events for the next 7 days in an AJAX-driven box or displaying a full list of upcoming events. You can try it out in a temporary copy of WordPress here.

View on WordPress.org