The vulnerability is a stored cross‑site scripting flaw that allows malicious code to be saved in event attribute fields. The code is stored without proper sanitization – only the basic wp_unslash() function is used – and is later rendered directly on the event page without escaping. An attacker who can submit an event or edit one with Author-level access can inject JavaScript that will execute in the browsers of any visitor to that event page, enabling session hijacking, defacement, or other browser‑based attacks.

The issue affects the Events Manager – Calendar, Bookings, Tickets, and more! WordPress plugin supplied by NetWeBlogic in all released versions up to and including 7.3.3. No other specific vendors or versions are identified in the advisory.

The CVSS score of 5.4 indicates moderate severity, and the vulnerability is listed as not included in the CISA KEV catalog. While the EPSS score is unavailable, the flaw can be exploited by authenticated users with Author-level permission or by unauthenticated users if the site allows anonymous event submissions. Once an attacker injects a malicious attribute, the script will run for every subsequent page view, meaning the impact can affect all users who view the compromised event page.