An attacker can inject malicious JavaScript into content stored by the Events Manager – OpenStreetMaps plugin. The injected code is then served to any user who views the affected page, allowing credential theft, session hijacking, or defacement. The weakness is a classic Stored XSS (CWE‑79) that compromises integrity and confidentiality of the victim in browsers that retrieve the pluggable content.

The vulnerability is present in Stonehenge Creations' Events Manager – OpenStreetMaps plugin through version 4.2.1, inclusive. Any WordPress site running a vulnerable plugin instance, regardless of its user role, is affected. Versions beyond 4.2.1 are not impacted.

The CVSS score of 6.5 reflects a moderate severity with medium impact. The EPSS score of less than 1% indicates that exploitation is currently rare, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, because stored XSS exploits are easily triggered via infected content, the risk remains high for attackers who can gain write access to the plugin’s input fields; the attack vector is inferred to be via the WordPress admin interface or through endpoints that accept unsanitized user input.