The Simple WP Events plugin contains a stored cross‑site scripting flaw that allows an attacker to embed and persist malicious scripts in event content. If an attacker successfully injects code, any visitor who renders the compromised event will execute that code in the context of the site, potentially hijacking sessions, defacing content, or injecting further malware. The vulnerability is categorized as CWE‑79.

WPMinds Simple WP Events plugin versions up to and including 1.8.17 are impacted. Any installation running one of these versions should be treated as vulnerable until it is upgraded.

With a CVSS score of 6.5, the flaw is considered moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation in the near term, and the vulnerability is not currently listed in the CISA KEV database. Based on the description, exploitation likely requires the ability to create or edit event content; this is inferred to mean that an authenticated attacker with such privileges could place the XSS payload. Once stored, the script executes for all viewers of the event. The overall risk is therefore moderate, but the potential impact on user accounts and site integrity warrants timely action.