The vulnerability is a DOM‑based cross‑site scripting flaw caused by improper input neutralization during web page generation. An attacker who can influence the content rendered by the Eventbee RSVP Widget could inject and execute malicious scripts in the victim’s browser. Successful exploitation permits defacement, cookie theft, session hijacking, and other actions that compromise the confidentiality or integrity of the site from the victim’s perspective.

This weakness exists in the WordPress Eventbee RSVP Widget plugin provided by eventbee. Any installation of the plugin with version 1.0 or earlier is affected; the vulnerable range is listed as n/a through <= 1.0.

The CVSS base score for this issue is 6.5, indicating a medium severity level. The EPSS score < 1% suggests a low probability of exploitation in the near term, and it is not currently listed in the CISA KEV catalog. The attack vector most likely involves a user visiting a page that renders user‑controlled data from the plugin, as the flaw is DOM‑based. Because there is no known patch or workaround supplied by the CNA, sites remain exposed until the plugin is upgraded or removed.