Plugin security history

Community Events Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 12 vulnerability records associated with Community Events, published between 2015 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

12Total records

3Critical

2High

7Medium

0Low

0Informational

12Patched records

0Currently marked unpatched

2015-04-20First disclosure

2026-03-06Latest disclosure

12 of 12CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2015	1	1 records
2021	1	1 records
2022	1	1 records
2024	2	2 records
2025	4	4 records
2026	3	3 records

Severity Breakdown

Severity	Records	Share
Critical	3	25%
High	2	16.7%
Medium	7	58.3%

Vulnerability-Type Breakdown

SQL Injection

5 records41.7%

First: 2015. Latest: 2026.

Cross-Site Scripting

5 records41.7%

First: 2021. Latest: 2026.

CSRF

1 record8.3%

First: 2024. Latest: 2024.

Missing Authorization

1 record8.3%

First: 2026. Latest: 2026.

Patch Status

Patched: 12
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

1.5.9
1.5.8
1.5.7
1.5.5
1.5.3
1.5.2
1.5.1
1.5
1.4.9
1.4.8
1.4

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-1.5.8`	Community Events <= 1.5.8 - Authenticated (Administrator+) SQL Injection via 'ce_venue_name' CSV Field	March 6, 2026	1.5.9	Medium
`*-1.5.7`	Community Events <= 1.5.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'ce_venue_name' Parameter	February 17, 2026	1.5.8	Medium
`*-1.5.6`	Community Events <= 1.5.6 - Missing Authorization to Unauthenticated Arbitrary Event Approval via 'eventlist' Parameter	January 16, 2026	1.5.7	Medium
`*-1.5.4`	Community Events <= 1.5.4 - Unauthenticated SQL Injection	November 18, 2025	1.5.5	High
`*-1.5.2`	Community Events <= 1.5.2 - Unauthenticated Stored Cross-Site Scripting	October 31, 2025	1.5.3	High
`*-1.5.1`	Community Events <= 1.5.1 - Unauthenticated SQL Injection	October 8, 2025	1.5.2	Critical
`*-1.5.1`	Community Events <= 1.5.1 - Unauthenticated SQL Injection	October 7, 2025	1.5.2	Critical
`*-1.5`	Community Events <= 1.5 - Authenticated (Admin+) Stored Cross-Site Scripting	July 15, 2024	1.5.1	Medium
`*-1.4.9`	Community Events <= 1.4.9 - Cross-Site Request Forgery	July 1, 2024	1.5	Medium
`*-1.4.8`	Community Events <= 1.4.8 - Authenticated (Administrator+) Stored Cross Site Scripting	November 25, 2022	1.4.9	Medium
`[*, 1.4.8)`	Community Events <= 1.4.7 - Reflected Cross-Site Scripting	July 2, 2021	1.4.8	Medium
`*-1.3`	Community Events < 1.4 - SQL Injection	April 20, 2015	1.4	Critical

Selected source records

Latest Records

MediumCVE-2026-2429

Community Events <= 1.5.8 - Authenticated (Administrator+) SQL Injection via 'ce_venue_name' CSV Field

Published: March 6, 2026

Affected versions: *-1.5.8
Patched versions: 1.5.9

Original Wordfence record

MediumCVE-2026-1649

Community Events <= 1.5.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'ce_venue_name' Parameter

Published: February 17, 2026

Affected versions: *-1.5.7
Patched versions: 1.5.8

Original Wordfence record

MediumCVE-2025-14029

Community Events <= 1.5.6 - Missing Authorization to Unauthenticated Arbitrary Event Approval via 'eventlist' Parameter

Published: January 16, 2026

Affected versions: *-1.5.6
Patched versions: 1.5.7

Original Wordfence record

HighCVE-2025-12646

Community Events <= 1.5.4 - Unauthenticated SQL Injection

Published: November 18, 2025

Affected versions: *-1.5.4
Patched versions: 1.5.5

Original Wordfence record

HighCVE-2025-11995

Community Events <= 1.5.2 - Unauthenticated Stored Cross-Site Scripting

Published: October 31, 2025

Affected versions: *-1.5.2
Patched versions: 1.5.3

Original Wordfence record

CriticalCVE-2025-10586

Community Events <= 1.5.1 - Unauthenticated SQL Injection

Published: October 8, 2025

Affected versions: *-1.5.1
Patched versions: 1.5.2

Original Wordfence record

CriticalCVE-2025-10587

Community Events <= 1.5.1 - Unauthenticated SQL Injection

Published: October 7, 2025

Affected versions: *-1.5.1
Patched versions: 1.5.2

Original Wordfence record

MediumCVE-2024-6270

Community Events <= 1.5 - Authenticated (Admin+) Stored Cross-Site Scripting

Published: July 15, 2024

Affected versions: *-1.5
Patched versions: 1.5.1

Original Wordfence record

Highest-Severity Records

CriticalCVE-2015-3313

Community Events < 1.4 - SQL Injection

Published: April 20, 2015

Affected versions: *-1.3
Patched versions: 1.4

Original Wordfence record

CriticalCVE-2025-10586

Community Events <= 1.5.1 - Unauthenticated SQL Injection

Published: October 8, 2025

Affected versions: *-1.5.1
Patched versions: 1.5.2

Original Wordfence record

CriticalCVE-2025-10587

Community Events <= 1.5.1 - Unauthenticated SQL Injection

Published: October 7, 2025

Affected versions: *-1.5.1
Patched versions: 1.5.2

Original Wordfence record

HighCVE-2025-12646

Community Events <= 1.5.4 - Unauthenticated SQL Injection

Published: November 18, 2025

Affected versions: *-1.5.4
Patched versions: 1.5.5

Original Wordfence record

HighCVE-2025-11995

Community Events <= 1.5.2 - Unauthenticated Stored Cross-Site Scripting

Published: October 31, 2025

Affected versions: *-1.5.2
Patched versions: 1.5.3

Original Wordfence record

MediumCVE-2021-24496

Community Events <= 1.4.7 - Reflected Cross-Site Scripting

Published: July 2, 2021

Affected versions: [*, 1.4.8)
Patched versions: 1.4.8

Original Wordfence record

MediumCVE-2022-44742

Community Events <= 1.4.8 - Authenticated (Administrator+) Stored Cross Site Scripting

Published: November 25, 2022

Affected versions: *-1.4.8
Patched versions: 1.4.9

Original Wordfence record

MediumCVE-2025-14029

Community Events <= 1.5.6 - Missing Authorization to Unauthenticated Arbitrary Event Approval via 'eventlist' Parameter

Published: January 16, 2026

Affected versions: *-1.5.6
Patched versions: 1.5.7

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory