The vulnerability is a stored cross‑site scripting flaw in the Events Manager WordPress plugin. The flaw exists in the ‘events_list_grouped’ shortcode, which accepts user‑supplied attributes without proper sanitization or escaping. An authenticated attacker who has contributor level or higher can embed malicious scripts in these attributes, resulting in arbitrary JavaScript that runs in the browsers of any user who views a page containing the injected shortcode. This is a CWE‑79 input validation weakness that can lead to session hijacking, credential theft, or defacement.

WordPress sites that have the Events Manager – Calendar, Bookings, Tickets, and more! plugin installed from its earliest releases up to and including version 7.2.2.1 are affected. The flaw resides in the plugin’s shortcode and any site that uses it is at risk. The product is provided by Netweblogic.

The CVSS score of 6.4 indicates a medium severity. The EPSS score of less than 1% suggests a very low current exploitation probability, and the vulnerability is not yet listed in the CISA KEV catalog. However, the flaw requires legitimate contributor‑level credentials, so it is limited to sites with users having that level of access. Once an attacker injects the payload, every other site visitor will execute the malicious script, providing a consistent and persistent XSS risk.