CVE-2025-24585

WordPress Event post plugin <= 5.9.7 - Stored Cross Site Scripting (XSS) vulnerability

Published Jan 24, 2025 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Event post event-post allows Stored XSS.This issue affects Event post: from n/a through <= 5.9.7.

Analysis

Technical impact

Improper neutralization of user‑supplied input during web page generation allows an attacker to inject and store malicious scripts in content managed by the Event post plugin. The stored payload can execute in the browsers of visitors who view the affected content, potentially leading to session hijacking, defacement, or phishing. This flaw is a typical stored cross‑site scripting weakness (CWE‑79).

Affected Systems

The vulnerability affects the WordPress Event post plugin developed by Bastien Ho, versions n/a through 5.9.7. Any WordPress installation running these versions is susceptible.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of less than 1 % suggests that, at the time of analysis, exploitation is unlikely but not impossible. The vulnerability is not currently listed in the CISA KEV catalog. It is inferred that the attack vector involves the plugin’s content submission interface, possibly requiring authenticated access, but unauthenticated users may be able to trigger the stored script if the plugin allows public posting.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Bastien Ho

Event post

unaffected

Version	Status	Constraints
`0`	affected	≤ 5.9.7

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Event post plugin to a version newer than 5.9.7, the latest release available.
If a newer version is unavailable, remove the plugin from the active plugin list and restrict or block content submission until a patch is applied.
After remediation, verify that no previously injected scripts are present by reviewing stored content and performing a site‑wide XSS scan.

Generated by OpenCVE AI on May 1, 2026 at 18:57 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-3790	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in N.O.U.S. Open Useful and Simple Event post allows Stored XSS. This issue affects Event post: from n/a through 5.9.7.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.383% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://patchstack.com/database/Wordpress/Plugin/event-post/vulnerability/wordpress-event-post-plugin-5-9-7-stored-cross-site-scripting-xss-vulnerability?_s_id=cve

History

Apr 23, 2026 3:00 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}`

Apr 1, 2026 11:45 PM Description updated. References updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in N.O.U.S. Open Useful and Simple Event post allows Stored XSS. This issue affects Event post: from n/a through 5.9.7.	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Event post event-post allows Stored XSS.This issue affects Event post: from n/a through <= 5.9.7.
References	https://patchstack.com/database/wordpress/plugin/event-post/vulnerability/wordpress-event-post-plugin-5-9-7-stored-cross-site-scripting-xss-vulnerability?_s_id=cve	https://patchstack.com/database/Wordpress/Plugin/event-post/vulnerability/wordpress-event-post-plugin-5-9-7-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
Metrics	cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}`

Jan 24, 2025 7:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jan 24, 2025 5:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in N.O.U.S. Open Useful and Simple Event post allows Stored XSS. This issue affects Event post: from n/a through 5.9.7.
Title		WordPress Event post plugin <= 5.9.7 - Stored Cross Site Scripting (XSS) vulnerability
Weaknesses		CWE-79
References		https://patchstack.com/database/wordpress/plugin/event-post/vulnerability/wordpress-event-post-plugin-5-9-7-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}`