The MicahBlu RSVP ME plugin for WordPress contains an improper neutralization of input during web page generation, resulting in stored cross‑site scripting. Input submitted via the plugin’s form is retained and later rendered without proper sanitization, so that a malicious script can be executed in the browsers of any user who views the affected content. The vulnerability does not specify particular consequences beyond the execution of injected code.

WordPress sites running MicahBlu RSVP ME plugin version 1.9.9 or earlier.

The CVSS score of 6.5 indicates moderate severity, while an EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to supply crafted input through the plugin’s form to embed malicious code; this attack path is inferred from the nature of stored XSS.