PT-2025-41329 · WordPress · Wordpress Community Events

Ifoundbug · Published 2025-10-09 · Updated 2025-11-08 · CVE-2025-10586

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WordPress Community Events plugin versions through 1.5.1

Description The WordPress Community Events plugin is susceptible to a SQL Injection issue due to inadequate input sanitization of the event venue parameter. This allows authenticated attackers with Subscriber-level access or higher to inject additional SQL queries into existing database queries, potentially leading to the extraction of sensitive information. The event venue parameter is vulnerable because of insufficient escaping and a lack of proper preparation of the SQL query.

Recommendations Versions prior to and including 1.5.1 should be updated.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-10586

Affected Products

Wordpress Community Events

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-10586 · Security Note
• https://twitter.com/0dayPublishing/status/1976111398250803295 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/92f3b923-884e-4f61-9bf8-62dfb267a27e?source=cve · Note
• https://twitter.com/CveFindCom/status/1976115292527903160 · Twitter Post
• https://twitter.com/offseq/status/1976121089718624311 · Twitter Post
• https://reddit.com/r/u_ZiradielR13/comments/1orygtq/threat_feed_integration · Reddit Post
• https://twitter.com/MNovofastovsky/status/1977371987639959626 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1976161868411543662 · Twitter Post
• https://wordpress.org/plugins/community-events · Note
• https://twitter.com/ZeroPathLabs/status/1976118629432234167 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3369351%40community-events%2Ftrunk&old=3115222%40community-events%2Ftrunk&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/browser/community-events/trunk/community-events.php?rev=3115223 · Note