The Community Events WordPress plugin processes public event submissions without authorization checks or nonce validation and fails to escape several submitted fields. This flaw allows an unauthenticated user to inject arbitrary scripts that are rendered in both the administrative dashboard public calendar, resulting in stored cross‑site scripting (XSS) that executes in the browsers of administrators reviewing event submissions.

Users of the Community Events plugin from version 1.4.9 through 1.5.9 (any release prior to 1.6.0) are impacted.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, but the lack of authentication and sanitization provides a low‑bar attack path. An attacker can submit a crafted event entry via the public interface, and the stored script will run in the context of any administrator who views the event, enabling session hijacking, credential theft, or other malicious actions.