The vulnerability in the Eventbee Ticketing Widget plugin is a stored cross‑site scripting flaw caused by improper sanitization of user input in the 'eventbeeticketwidget' shortcode. An attacker who can authenticate with contributor level or higher can inject arbitrary JavaScript that will be stored and then executed for every user who visits the affected page. This flaw violates CWE‑79 and compromises browser‑based confidentiality and integrity, potentially allowing credential theft, session hijacking, or defacement.

WordPress sites running any version of the Eventbee Ticketing Widget plugin up to and including 1.0 are affected. The plugin is offered by the vendor eventbee and is widely deployed as a WordPress plugin; no version newer than 1.0 is known to contain the fix.

The CVSS score of 6.4 indicates a moderate severity flaw. The EPSS score of less than 1% suggests the probability of exploitation in the wild is low at this time, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a user to be authenticated with contributor privileges, so the attack vector is login‑based. Once authentication is achieved, the attacker can add malicious script content that will run when any user views the injected page.