The vulnerability resides in the Improper Neutralization of Input During Web Page Generation weakness that allows stored XSS. An attacker who can inject malicious code into the plugin’s data store can later cause that code to execute in the browsers of any user who views the affected page. This can lead to information theft, session hijacking, or delivery of further malware, all without the need for a separate exploit. The weakness is identified as CWE‑79.

The affected product is the CoolHappy The Events Calendar Countdown Addon used in WordPress sites. Any installation of the addon with a version up to and including 1.4.9 is vulnerable; earlier releases are also listed as affected. Site administrators should audit their plugins to determine which versions they are running.

The CVSS score is 6.5, indicating moderate severity. The EPSS score shows a probability of exploitation of less than 1%, and the vulnerability is not listed in the CISA KEV catalog. Given the stored‑XSS nature, an attacker would have to supply input that is stored by the plugin, but once stored, the code executes for all page viewers. The risk is moderate with low likelihood based on current exploitation data.