The mentioned plugin implements DOM‑based cross‑site scripting due to improper input neutralization. An attacker can construct a malicious payload that is reflected by the browser’s DOM and executed as JavaScript in the victim’s context, potentially allowing credential theft, session hijacking, or defacement. This potential impact is inferred from typical XSS consequences and is not explicitly stated in the CVE description.

The vulnerability exists in the WordPress Event post plugin developed by Bastien Ho, affecting every installation of the plugin up to and including version 5.9.11. Any WordPress site that includes this plugin before the patch is susceptible.

The CVSS score of 6.5 classifies the bug as a moderate‑severity issue. An EPSS score of less than 1 % indicates that, at the present time, the probability of this flaw being actively exploited is low. The plugin is not listed in the CISA KEV catalog. Exploitation requires the victim to load a page rendered by the compromised plugin or interact with input fields that are not properly sanitized, implying a client‑side attack vector that depends on user interaction or phishing; this inference comes from the fact that the flaw is DOM‑based, though the exact method is not detailed in the CVE entry.