Improper neutralization of user‑supplied input during web page generation in the WP Event Ticketing plugin allows reflected client‑side script injection, as defined by CWE‑79. An attacker could embed JavaScript in a URL that, when visited by a user, executes in the victim’s browser, enabling cookie theft, session hijacking, defacement or delivery of additional malware. The vulnerability affects the content shown to users and can compromise the integrity and trust of the site.

The WordPress WP Event Ticketing plugin released by toddhuish, version 1.3.4 and any earlier releases, is impacted. No other vendors or products are listed as affected.

The CVSS score of 7.1 indicates moderate‑to‑high severity, while the EPSS score of less than 1% shows a low probability of exploitation at present. The issue is not included in the CISA KEV catalog. Attack vectors are inferred to be web‑based: an attacker can embed a malicious payload in a crafted link that is shared or posted to the site. When a visitor clicks or loads the link, the payload will run with the privileges of the user’s browser, potentially leading to hijacking of the session or defacement.