The WpEvently plugin for WordPress is vulnerable to stored cross‑site scripting via multiple parameters in all versions up to and including 4.4.2 due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary JavaScript that executes whenever a user visits an injected page. The flaw falls under CWE‑79 and carries a CVSS score of 6.4.

The affected product is the Event Booking Manager for WooCommerce plugin from MagePeopleTeam, deployed on WordPress sites. All plugin releases up to version 4.4.2 are impacted; versions 4.4.3 and newer have addressed the issue.

The exploitation probability is low with an EPSS score below 1 %. The flaw is not listed in the CISA KEV catalog. Attackers must first be authenticated with at least Contributor role, which is typically granted to users who can create or edit events. Once the vulnerability is leveraged, the injected script runs in the context of the site, potentially allowing session hijacking, defacement, or phishing attacks against all site visitors. Due to the need for valid credentials, the risk is moderate rather than high.