This vulnerability is an improper neutralization of input during page generation that enables reflected XSS. By submitting unsanitized data through the plugin’s input fields, an attacker can embed and execute arbitrary JavaScript in the rendered page, potentially compromising user sessions or delivering malicious content. The weakness is identified as CWE-79.

The affected product is the WordPress plugin Evangelische Termine, version 3.3 and earlier, provided by the vendor regibaer. Users running any of these versions are susceptible to the flaw.

The CVSS score of 7.1 indicates a high severity. The EPSS score of less than 1% suggests a low current likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be reflected XSS, meaning an attacker must lure a victim to visit a crafted link or submit a request that includes malicious input. Successful exploitation requires the victim’s browser to process the unsanitized content, leading to potential session hijacking or defacement.