The vulnerability enables an attacker to inject malicious scripts into webpages generated by the Event post plugin. This improper neutralization of input during page generation allows execution of arbitrary JavaScript in a visitor’s browser when it views affected content, potentially leading to data theft, session hijacking, or defacement. The weakness is an input‑validation flaw classified as CWE‑79.

The Event post plugin, developed by Bastien Ho, is vulnerable in all versions from its earliest release through 5.10.3. Any WordPress installation that installs or leaves an affected version of this plugin is at risk. No specific WordPress core version is mentioned, so the scope extends to all sites using a pre‑5.10.3 version of Event post.

The CVSS score of 6.5 indicates a moderate severity, and the EPSS score of less than 1% suggests that exploitation is not widely observed, though the risk is not zero. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an attacker crafting a malicious payload within a user‑controlled field that the plugin renders without proper escaping, which is a straightforward request injection scenario. Given this, the likelihood of exploitation remains low but could increase if the plugin is widely used.