The Community Events plugin for WordPress is vulnerable to stored cross‑site scripting via the ce_venue_name parameter. This flaw arises from insufficient input sanitization and output escaping and allows an attacker who can authenticate with administrator‑level or higher privileges to inject arbitrary JavaScript or other web scripts into the plugin’s stored venue information. Once injected, the scripts execute whenever any user loads the affected page, thereby compromising the confidentiality, integrity, and potentially availability of the affected WordPress site.

All installations of the Community Events WordPress plugin from jackdewey that run version 1.5.7 or earlier are affected. The vulnerability is present in the plugin’s core code that processes the ce_venue_name field, and there is no known fix in versions up to and including 1.5.7.

The CVSS score of 4.4 indicates a medium severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. However, the vulnerability requires authenticated administrators, making it an internal risk if privileged accounts are compromised or if an insider misuses the capability. Because it is not listed in the CISA KEV catalog, there is currently no known active exploitation. Attackers would exploit the flaw by submitting a malicious venue name through the event creation interface, after which the malicious payload is stored and rendered without proper escaping.