WordPress Events Plugin Stored XSS via Unauthenticated Submissions

The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks when processing public event submissions, and does not escape several of the submitted values before outputting them in the administration dashboard and on the public calendar, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of an administrator reviewing the submission.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Community Events WordPress plugin before version 1.6.0 contains a stored cross-site scripting (XSS) vulnerability that allows unauthenticated attackers to inject malicious JavaScript into event submissions. Because the plugin fails to implement proper authorization checks, nonce validation, and output escaping, attackers can craft malicious event entries that execute arbitrary scripts in the browsers of administrators and site visitors. This vulnerability affects any WordPress installation running the vulnerable plugin version, making it particularly dangerous since WordPress sites are frequently targeted and event plugins are commonly used for community engagement and booking systems.

Casky's skill mapping across MITRE ATT&CK TA0001 (Reconnaissance) and TA0043 (Reconnaissance) enables detection of the attack chain leading to this vulnerability. Practitioners using Casky would identify findings related to T1592 (Gather Victim Org Information) as attackers probe for plugin presence, T1589 (Gather Victim Identity Information) during submission crafting, and critically, T1059 (Command and Scripting Interpreter) patterns when malicious payloads are injected. The platform's 323 matching skills would surface indicators including: absence of nonce tokens in form handlers, missing capability checks on submission processing, unescaped output in administrative interfaces, and stored payload execution. Security teams would see attack progression flagged through input validation failures (CWE-79) and could correlate these signals with administrator session hijacking or data exfiltration attempts that follow successful XSS exploitation.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-86794.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-86794

Casky has 323 skills that investigate the attack patterns behind CVE-2026-86794. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn