The Community Events plugin for WordPress is vulnerable to stored cross-site scripting, allowing unauthenticated attackers to execute arbitrary web scripts in victim browsers.

This vulnerability is a Stored Cross-Site Scripting (XSS) flaw occurring within the event details parameter. The lack of proper input sanitization and output escaping allows an unauthenticated attacker to inject malicious scripts that execute when a user views the affected page.

The ability for an unauthenticated attacker to inject arbitrary scripts poses a significant risk to site integrity and user security. Successful exploitation could lead to session hijacking, unauthorized actions performed on behalf of site administrators, or the redirection of users to malicious external domains, damaging the reputation of the platform. With a CVSS score of 7.2, this vulnerability is classified as High severity and requires immediate attention to prevent compromise.

Immediate Action: There is currently no confirmed patched version available; administrators should immediately deactivate and remove the Community Events plugin until a secure update is released by the vendor.

Proactive Monitoring: Review web server access logs for suspicious POST requests targeting the event submission endpoints and monitor for unexpected script tags appearing in event detail pages.

Compensating Controls: Deploy a Web Application Firewall (WAF) with robust XSS protection rules to identify and block malicious script injection attempts targeting this parameter.

Public Exploit Available: Unknown.

Given the High severity of this stored XSS vulnerability and the ability for unauthenticated actors to trigger script execution, organizations should prioritize the removal of the vulnerable plugin. Until the vendor provides a secure version, the risk of cross-site scripting remains elevated for any site using versions 1.5.2 or earlier.