An improper neutralization of input during web page generation allows attackers to store malicious JavaScript that will execute whenever an event page is viewed, enabling credential theft, phishing, or defacement. The vulnerability falls under CWE‑79 and grants the attacker persistent client‑side code execution via stored XSS.

All WordPress sites that have the Events Maker by dFactory plugin installed with version 1.6.14 or earlier are affected. The range of affected releases is from the plugin’s initial public version up to and including 1.6.14.

The CVSS score of 6.5 indicates moderate severity, while an EPSS score of <1% suggests a low probability of exploitation at the time of analysis. The vulnerability is not listed in CISA’s KEV catalog. Externally, the likely attack path involves an attacker creating or editing an event within the plugin’s interface, injecting malicious code that is then rendered in later views of the event page. The exploit requires the ability to submit event data and for the site to display that data without proper escaping.