The WP Event Manager plugin contains a stored cross‑site scripting vulnerability in the 'organizer_name' field. An attacker can submit arbitrary JavaScript that is saved in the database and executed in the browsers of any user who views the injected page. This flaw allows unauthenticated exploitation and can lead to client‑side code execution, cookie theft, defacement, and related attacks.

WordPress sites running the WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin, any version up to and including 3.1.50.

The CVSS score of 7.2 classifies the issue as high severity, yet the EPSS score of <1% suggests a modest likelihood of exploitation. It is not listed in CISA KEV, implying no widespread or known active exploitation. The flaw is unauthenticated and requires the attacker to supply a malicious value for organizer_name, which the application stores without proper sanitization or escaping.