CVE-2026-86794— Community Events 1.4.9 - 1.5.9 - Unauthenticated Stored XSS via Event Submission Form
Quick assessment
Affected
Unknown Community Events
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
1.6.0 版本之前的 Community Events WordPress 插件在处理公开活动提交时，未进行授权验证或 nonce 检查，且在将多个提交值输出到管理后台和公开日历前未进行转义处理。这使得未认证用户能够注入任意 Web 脚本，这些脚本将在查看该提交的管理员浏览器中执行。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86794
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Community Events 1.4.9 - 1.5.9 - Unauthenticated Stored XSS via Event Submission Form
Source: CVE Program / CVE List V5
Vulnerability Description
The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks when processing public event submissions, and does not escape several of the submitted values before outputting them in the administration dashboard and on the public calendar, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of an administrator reviewing the submission.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Community Events | 1.4.9 ~ 1.6.0 | - |
|
II. Public POCs for CVE-2026-86794
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86794
请登录查看更多情报信息。
Other References for CVE-2026-86794 (1)
-
https://wpscan.com/vulnerability/058aa2e1-0b9c-431f-b0e4-4e93e4977a63/ exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-10-29 · 28 CVEs total
| CVE-2026-115303 | 3.7 LOW | Contact Form by Supsystic < 1.11.1 - Unauthenticated CRLF / Email Header Injection via Rep |
| CVE-2026-103693 | Frontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object Injectio | |
| CVE-2026-115282 | Recipe Card Blocks Lite 2.6.4 - 3.6.3 - Unauthenticated Unpublished Post Content Disclosur | |
| CVE-2026-115302 | Contact Form by Supsystic < 1.11.1 - Unauthenticated Arbitrary Statistics Deletion | |
| CVE-2026-115301 | Contact Form by Supsystic < 1.11.1 - Admin+ SSTI via Form Text Block | |
| CVE-2026-115299 | Contact Form by Supsystic < 1.11.1 - Arbitrary Plugin Settings Update via CSRF | |
| CVE-2026-115300 | Contact Form by Supsystic < 1.11.1 - Contact Submission and Statistics Deletion via CSRF | |
| CVE-2026-88928 | PAYCOMET for WooCommerce 5.36 - 5.45 - Unauthenticated Stored Payment Token Overwrite via | |
| CVE-2026-78395 | Link Library < 7.10.0 - Unauthenticated Link Submission Login Requirement Bypass | |
| CVE-2026-78396 | Link Library < 7.10.0 - Unauthenticated Link Contact and Submitter Information Disclosure | |
| CVE-2026-89216 | vTables < 0.3 - Unauthenticated SQL Injection via orderby Parameter | |
| CVE-2026-108763 | Wallet System for WooCommerce < 2.8.2 - Subscriber+ KYC Document Overwrite via IDOR | |
| CVE-2026-108686 | WP Post Author < 4.2.0 - Unauthenticated reCAPTCHA Secret Key Disclosure | |
| CVE-2026-108685 | WP Post Author < 4.2.0 - Unauthenticated Modification of the First User Account's Profile | |
| CVE-2026-105258 | LatePoint < 5.7.6 - Admin+ Stored XSS via Booking Form Step Settings | |
| CVE-2024-3586 | LetterPress < 2.4.0 - Admin+ Stored XSS | |
| CVE-2026-110504 | Enable SVG, WebP, and ICO Upload 1.1.3 - 1.1.5 - Author+ Stored XSS via SVG Sanitization B | |
| CVE-2026-110030 | Hide Price Until Login < 1.1.2 - Unauthenticated Account Creation via Guest Registration | |
| CVE-2026-110983 | WP Photo Album Plus < 9.3.04.004 - Photo Comment Deletion via CSRF | |
| CVE-2026-110505 | Enable SVG, WebP, and ICO Upload < 1.1.6 - Author+ Stored XSS via SMIL Animation Bypass |
Showing top 20 of 28 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Community Events
-
CVE-2026-2429
Community Events <= 1.5.8 - Authenticated (Administrator+) S -
CVE-2026-1649
Community Events <= 1.5.7 - Authenticated (Administrator+) S -
CVE-2025-14029
Community Events <= 1.5.6 - Missing Authorization to Unauthe -
CVE-2025-12646
Community Events <= 1.5.4 - Unauthenticated SQL Injection -
CVE-2025-11995
Community Events <= 1.5.2 - Unauthenticated Stored Cross-Sit
Same vendor: Unknown
-
CVE-2026-115303
Contact Form by Supsystic < 1.11.1 - Unauthenticated CRLF / -
CVE-2026-85007
YT Player < 2.1.4 - Contributor+ Missing Authorization via y -
CVE-2026-114270
GeoDirectory < 2.8.197 - Unauthenticated Password-Protected -
CVE-2026-113617
Automated Import Products to Cart < 1.0.4 - Subscriber+ Arbi -
CVE-2026-115245
Chat AI with Dispatcher < 2.4 - Unauthenticated Arbitrary Fi