Improper neutralization of user input in the WordPress Eventin plugin causes a reflected XSS flaw that allows a malicious actor to inject and execute arbitrary JavaScript in site visitors’ browsers. The primary consequence is the execution of attacker‑controlled code in the victim’s context, which can lead to session hijacking, credential theft, defacement, or delivery of further malware. The vulnerability is exploitable through normal web traffic to the plugin’s frontend endpoints.

The WordPress Eventin plugin by Arraytics (Eventin wp‑event‑solution) for WordPress is affected when its version is 4.0.28 or earlier. Versions newer than 4.0.28 contain the fix.

The CVSS score of 7.1 indicates moderate‑to‑high severity. The EPSS score of < 1 % suggests that the probability of immediate exploitation is low, although the vulnerability can still be leveraged via crafted URLs or form input. The issue is not listed in the CISA KEV catalog. The likely attack vector is standard HTTP requests to the plugin’s components, where attacker‑supplied payloads are reflected unsanitized into the HTML response and executed in the victim’s browser.