The Event post plugin for WordPress includes a stored cross‑site scripting flaw that allows attackers to inject malicious JavaScript into event content. Unsanitized user input is stored in the database and rendered when recipients view the event, enabling cookie theft, defacement, or further code execution in the victim’s browser. The weakness is a classic input‑validation failure (CWE‑79).

The plugin, released by Bastien Ho, is affected in all versions up to and including 5.9.8. The vulnerability has been identified as active from the earliest release through 5.9.8, affecting every build within that range.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1 % suggests a low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply malicious content via the plugin’s input fields. Based on the description, it is inferred that a likely attack vector is the event creation or editing interface, which accepts user‑supplied post data. Once a payload is stored, it is served to any user who views the compromised event, potentially compromising accounts or delivering additional malicious code.