Improper neutralization of user‑supplied input during web page generation allows an attacker to inject and store malicious scripts in content managed by the Event post plugin. The stored payload can execute in the browsers of visitors who view the affected content, potentially leading to session hijacking, defacement, or phishing. This flaw is a typical stored cross‑site scripting weakness (CWE‑79).

The vulnerability affects the WordPress Event post plugin developed by Bastien Ho, versions n/a through 5.9.7. Any WordPress installation running these versions is susceptible.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of less than 1 % suggests that, at the time of analysis, exploitation is unlikely but not impossible. The vulnerability is not currently listed in the CISA KEV catalog. It is inferred that the attack vector involves the plugin’s content submission interface, possibly requiring authenticated access, but unauthenticated users may be able to trigger the stored script if the plugin allows public posting.