The XT Event Widget for Social Events plugin for WordPress contains an improper handling of the filename used in a PHP include/require statement, allowing an attacker to request inclusion of arbitrary local files. This flaw maps to CWE‑98 and can potentially expose sensitive content or allow execution of unintended code if the included file contains PHP that will be interpreted by the server.

WordPress sites that have the Xylus Themes XT Event Widget for Social Events plugin version 1.1.7 or earlier installed. The plugin is distributed as a standard WordPress add‑on and is identified as Xylus Themes XT Event Widget for Social Events.

The CVSS score of 7.5 indicates a high risk from a confidentiality and integrity perspective. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is the local web server: an attacker with access to craft a request that triggers the insecure include, such as through a specially formed URL or query string that is processed by the plugin. Because the flaw relies on file inclusion on the local filesystem, it may be mitigated by restricting file permissions or removing the plugin entirely.