The Event post plugin for WordPress contains a stored cross‑site scripting flaw due to inadequate sanitization and escaping of user supplied attributes in the 'events_list' shortcode. All versions up to and including 5.9.9 are affected. An authenticated user with contributor‑level permissions can embed arbitrary JavaScript payloads that will be persisted in the plugin and executed whenever a page containing the shortcode is accessed. The consequence is the potential theft of cookies or session data, defacement, and other malicious client‑side actions on every visitor of the injected page.

The vulnerability exists in the WordPress Event post plugin produced by bastho. All plugin releases up to version 5.9.9 are vulnerable.

The CVSS score is 5.4, indicating a moderate risk. The EPSS score of less than 1% suggests a low likelihood of exploitation in the near term, and the flaw is not listed in the CISA KEV catalog. Exploitation requires an authenticated contributor or higher role, implying that attackers must first be authorized to post content. Once injected, the malicious script is stored and will run for all users who view the affected page, making the attack vector a stored XSS triggered by the plugin’s shortcode parsing.