The Digital Events Calendar plugin contains a stored cross‑site scripting flaw triggered by the ‘column’ parameter. Lack of input sanitization and output escaping allows an authenticated user with Contributor level or higher privileges to inject malicious scripts that execute when any user views a page containing the altered content. This can lead to defacement, theft of user credentials, or execution of arbitrary code within the visitor’s browser context.

The vulnerability affects all releases of the Digital Events Calendar plugin by rejuancse up to and including version 1.0.8. Any WordPress installation hosting this plugin is at risk if an attacker can obtain a Contributor or higher account.

The CVSS score of 6.4 categorises this as a moderate‑severity issue, and the EPSS score of less than 1 % indicates a low likelihood of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. Exploitation requires an authenticated account with Contributor+ permissions and proceeds by inserting malicious JavaScript via the vulnerable ‘column’ field. Once injected, the script runs for all users who view the affected page, potentially compromising user data and session integrity.