未評価

The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks...

CVE-2026-86794 SecPulse初出 15:00

影響パッケージ

種類	パッケージ	影響を受ける版	直った版
CVE	Community Events	1.4.9 以上 1.6.0 未満	1.6.0

原文の説明取得元が公開している説明をそのまま載せています (多くは英語)。

The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks when processing public event submissions, and does not escape several of the submitted values before outputting them in the administration dashboard and on the public calendar, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of an administrator reviewing the submission.

出典: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

参照URL

web contact@wpscan.com
web nvd.nist.gov
web wpscan.com
web github.com