CVE-2026-86794 Community Events 1.4.9 - 1.5.9 - Unauthenticated Stored XSS via Event Submission Form
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-86794?
CVE-2026-86794 is a high-severity vulnerability in Unknown Community Events, published on 29 Oct 2026.
Official description
The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks when processing public event submissions, and does not escape several of the submitted values before outputting them in the administration dashboard and on the public calendar, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of an administrator reviewing the submission.
Weakness: CWE-79
Which versions are affected by CVE-2026-86794?
How do I fix CVE-2026-86794?
No fix has been published for CVE-2026-86794 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-86794 being exploited?
There is no known exploitation of CVE-2026-86794 in the wild and no public exploit code.
Sources
Also known as GHSA-55j7-9hpq-4p98.