The plugin fails to neutralize user‑supplied input before displaying it, allowing attackers to inject JavaScript that persists across page loads. The persistent XSS can lead to compromise of user sessions, credential theft, or unauthorized defacement of the site, affecting confidentiality and integrity of affected WordPress users.

WordPress Event Manager, Event Calendar and Booking Plugin (themefunction) versions 4.0.24 and older are impacted. The vulnerability exists in all WordPress installations using those plugin versions.

The CVSS score of 6.5 classifies the flaw as medium severity. The EPSS is below 1%, indicating a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker must be able to create or modify content such as event descriptions that are later stored and rendered to visitors; it is not explicitly stated whether privileged access is required, so this is an inferred attack vector. Similarly, it is inferred that the flaw can be exploited via normal user input channels.