Threats tagged 'ghsa-55j7-9hpq-4p98'

The Community Events WordPress plugin versions prior to 1.6.0 lack authorization and nonce checks for processing public event submissions. Additionally, several submitted values are not properly escaped before being displayed in the admin dashboard and public calendar. This allows unauthenticated users to inject arbitrary web scripts that execute in the browsers of administrators reviewing the submissions.