CVE-2026-2429 - Community Events <= 1.5.8 - authenticated (administrator+) sql injection via 'ce_...

CVE ID :CVE-2026-2429 Published : March 7, 2026, 2:16 a.m. | 1 hour, 10 minutes ago Description :The Community Events plugin for WordPress is vulnerable to SQL Injection via the 'ce_venue_name' CSV field in the `on_save_changes_venues` function in all versions up to, and including, 1.5.8. This is due to insufficient escaping on the user-supplied CSV data and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via a crafted CSV file upload. Severity: 4.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...