The Import Social Events plugin (up to version 1.8.5) contains a stored cross‑site scripting flaw that allows an attacker to inject malicious scripts into content that is later rendered in the website’s pages. This weakness permits the execution of arbitrary client‑side code in the browsers of users who view affected pages, potentially leading to session hijacking, defacement, or the spread of malware. The vulnerability is identified as CWE‑79, which indicates improper input sanitization when generating web pages.

WordPress sites that have installed Xylus Themes Import Social Events plugin version 1.8.5 or earlier are affected. The vulnerability exists in all editions of the plugin distributed through the WordPress plugin repository.

The CVSS score of 6.5 places the flaw in the medium severity range, while the EPSS score of less than 1% suggests that exploitation is presently unlikely but not impossible. The plugin does not appear in the CISA KEV catalog, reducing the immediate threat perception from a national supply‑chain standpoint. The likely attack path involves using the event import feature to submit content that contains unsanitized script tags; the malicious payload is then stored and later rendered in the website’s front‑end. Successful exploitation would require the attacker to procure a site that runs the vulnerable plugin, but no known remote exploitation vector is documented in the advisory.