The Event RSVP and Simple Event Management Plugin is vulnerable to stored cross‑site scripting in the 'emd_mb_meta' shortcode due to insufficient input sanitization and output escaping of user‑supplied attributes. An authenticated user holding contributor or higher privileges can inject arbitrary scripts that execute whenever a site visitor loads a page containing the shortcode, enabling theft of session cookies, defacement, and other client‑side attacks.

All installations of the WordPress plugin Event RSVP and Simple Event Management Plugin from the WordPress repository with version numbers up to and including 4.1.0 are affected. The flaw manifests in every iteration of the plugin released in that range regardless of other installed plugins or themes.

The CVSS score of 6.4 indicates a moderate level of risk. The EPSS score of < 1% means that exploitation is expected to be very low in the wild at present, and the vulnerability is not listed in CISA KEV. However, exploitation only requires an authenticated contributor‑level account, which an attacker could obtain through credential compromise or phishing. Once such an account is available, the injected scripts will run in the context of any user viewing the affected page, and while the flaw does not give remote code execution on the server, it poses a significant threat to client‑side data and site integrity.