The CGM Event Calendar plugin for WordPress contains an improper neutralization of input during web page generation that allows attackers to inject arbitrary JavaScript via reflected XSS. This flaw permits malicious code to be executed in the browsers of visitors who view the affected event page.

The vulnerability affects the rzfarrell CGM Event Calendar WordPress plugin versions from the earliest release through 0.8.5. Any site running those versions is at risk; later releases are not impacted.

The likely attack vector is reflected XSS through malicious URLs or event entries. Based on the description, it is inferred that no explicit prerequisites beyond accessing the vulnerable event page are required, so the user can trigger the vulnerability remotely by visiting a crafted link. The CVSS score of 7.1 indicates a moderate-to-high severity level, and an EPSS score of less than 1% suggests that, as of now, the likelihood of exploitation is low. The flaw is not listed in CISA KEV.