The vulnerability occurs when the Conference Scheduler plugin accepts the ‘className’ parameter without sufficient sanitization or escaping. Authenticated users with Contributor or higher privileges can embed arbitrary JavaScript that is stored and later rendered when any user views the same page. The injected script runs with the context of the victim, enabling potential defacement, credential theft, or session hijacking. The weakness is classified as CWE‑79, indicating an input validation issue that leads to an XSS flaw.

The affected product is the Conference Scheduler WordPress plugin, developed by swift. All released versions up to and including 2.5.1 are impacted. Users running these plugin versions with Contributor or higher roles are at risk.

The CVSS score is 6.4, denoting moderate severity, while the EPSS probability is below 1 %, suggesting low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated session with at least Contributor privileges; the attacker then submits the malicious ‘className’ input through the plugin interface, which stores it in the database. When any page that includes the parameter is rendered, the stored script executes in the victim’s browser context.