The vulnerability allows authenticated users who possess Contributor or higher privileges to inject arbitrary JavaScript into pages through the ‘data‑date‑*’ parameters. The injected code is stored by the plugin and executes whenever another user views the affected page, enabling persistent script execution and manipulation of content visible to all site visitors.

The affected product is the Events Calendar plugin for WordPress, developed by StellarWP. All versions up to and including 6.13.2 are vulnerable; therefore any WordPress installation running these or earlier releases of the plugin is at risk.

The CVSS score of 6.4 indicates a moderate severity vulnerability. The EPSS score of <1% points to a low probability of exploitation in the current threat landscape. The vulnerability is not listed in the CISA KEV catalog. Attackers require authenticated access with at least Contributor level and would exploit the flaw by submitting malicious input via the plugin’s administrative interface, leading to persistent script execution in the context of other site users.