The vulnerability allows insertion of sensitive information into data that is sent externally. As a result, an attacker could retrieve embedded sensitive data that was not intended for public disclosure. The weakness is categorized as CWE‑201, which focuses on improper handling of sensitive data.

The affected product is the Metagauss EventPrime eventcalendar‑management WordPress plugin. Versions from the first release through 4.2.4.1 are impacted; any installation of the plugin on a WordPress site that has not been updated beyond that version is at risk.

The CVSS score of 4.3 places the vulnerability in the medium severity range, but the EPSS score of less than 1% suggests a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, indicating no publicly available exploits as of the time of analysis. The likely attack vector is normal plugin usage; an attacker could trigger the vulnerability by interacting with the exposed data export or view functions, but no additional access privileges or privileged execution are required.