CVE-2025-11995

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11995", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-20T20:16:57.146Z", "datePublished": "2025-11-01T04:27:40.961Z", "dateUpdated": "2026-04-08T16:59:08.592Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:59:08.592Z"}, "affected": [{"vendor": "jackdewey", "product": "Community Events", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.5.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Community Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event details parameter in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Community Events <= 1.5.2 - Unauthenticated Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6c12bcf6-6297-457a-a807-28f5dbacb0eb?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/community-events/trunk/community-events.php?rev=3115223"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3384504%40community-events&new=3384504%40community-events&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "ifoundbug"}], "timeline": [{"time": "2025-10-20T20:32:21.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-10-31T16:03:56.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-03T20:46:25.135257Z", "id": "CVE-2025-11995", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-03T20:46:33.926Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11995", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-03T20:46:25.135257Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-03T20:46:30.168Z"}}], "cna": {"title": "Community Events <= 1.5.2 - Unauthenticated Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "ifoundbug"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "jackdewey", "product": "Community Events", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.5.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-20T20:32:21.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-10-31T16:03:56.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6c12bcf6-6297-457a-a807-28f5dbacb0eb?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/community-events/trunk/community-events.php?rev=3115223"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3384504%40community-events&new=3384504%40community-events&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Community Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event details parameter in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:59:08.592Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11995", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:59:08.592Z", "dateReserved": "2025-10-20T20:16:57.146Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-01T04:27:40.961Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Community Events", "vendor": "jackdewey", "versions": [{"lessThanOrEqual": "1.5.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Community Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event details parameter in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Community Events para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del par\u00e1metro de detalles del evento en todas las versiones hasta la 1.5.2, inclusive, debido a la sanitizaci\u00f3n insuficiente de la entrada y el escape de la salida. Esto hace posible que atacantes no autenticados inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-11995", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11995", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-03T20:46:25.135257Z", "version": "2.0.3"}}]}, "published": "2025-11-01T05:16:02.430", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/community-events/trunk/community-events.php?rev=3115223"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3384504%40community-events&new=3384504%40community-events&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6c12bcf6-6297-457a-a807-28f5dbacb0eb?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T12:06:10.620399+00:00", "value": {"mitigation_remediation": ["Upgrade Community Events to version 1.5.3 or newer", "Restrict event creation and editing to administrator accounts only", "Apply server\u2011side sanitization or output escaping to the event details field as a temporary countermeasure"], "summary": {"action": "Update Plugin", "impact": "Stored Cross\u2011Site Scripting via event details"}, "threat_synthesis": {"affected_systems": "WordPress installations using the Community Events plugin from Jackdewey version 1.5.2 or earlier are affected. All releases up to and including 1.5.2 allow the flaw to be exercised.", "description_and_impact": "The Community Events plugin for WordPress contains a stored cross\u2011site scripting flaw that allows an attacker to embed arbitrary scripts into the event details field. Because input sanitization and output escaping are insufficient, the malicious script runs in the browser context of any user who views the affected event page. This flaw can be used to steal session cookies, deface the site, or perform other client\u2011side attacks without requiring authentication.", "risk_and_exploitability": "The CVSS score of 7.2 indicates a high severity vulnerability, but an EPSS score of less than 1% suggests that exploitation in the wild is currently rare. The flaw is not yet listed in the CISA KEV catalog. The attack vector is unauthenticated, relying on rogue input to the event details parameter, and any user who accesses the injected page will execute the injected code."}}}}, "created": "2025-11-03T10:43:38.826111+00:00", "updated": "2026-04-22T12:15:16.047019+00:00", "vendors": ["jackdewey", "jackdewey$PRODUCT$community_events", "wordpress", "wordpress$PRODUCT$wordpress"]}