This vulnerability is a reflected Cross‑Site Scripting flaw that is triggered by the 'calendar_header' parameter in the Events Manager plugin. The input is not properly sanitized or escaped, so an attacker can embed malicious JavaScript in the URL or form data. If a user visits the crafted link, the script runs in the context of the WordPress site and can execute arbitrary client‑side code.

All installations of the Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress up to and including version 7.0.3 are vulnerable. The issue originates in the plugin code that outputs the calendar_header value without filtering, regardless of user role, meaning any site running a vulnerable version is impacted.

The CVSS score of 6.1 indicates medium severity, while the EPSS score of < 1% signals a low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote, unauthenticated attacker crafting a malicious link that convinces a victim to click on it; no additional privileges are required beyond the victim’s visit.