The WP Event Manager plugin allows administrators to inject arbitrary JavaScript into the tag‑name field. Because the input is not properly sanitized or escaped, the injected code is stored and subsequently served to any user who accesses the affected page, leading to an execution environment controlled by the attacker. This stored XSS can be used to deface content, steal session cookies, redirect victims, or serve other malicious payloads.

All installations of WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin up to and including version 3.1.49. The issue is confined to multisite configurations where the WordPress capability unfiltered_html has been disabled, and only affects administrators or roles with equivalent privileges.

The CVSS score of 4.4 indicates a low impact when evaluated broadly, but the vulnerability is exploitable only by users who already possess administrator-level credentials and are on a multisite network with the specific unfiltered_html setting. The EPSS score is below 1 % and the vulnerability is not listed in CISA’s KEV catalog, suggesting a low probability of widespread exploitation. Nevertheless, the presence of an inactive capability and the requirement for admin access mean that organisations with loose role management may still face a risk of script execution on user‑facing pages.