The Events Manager plugin for WordPress stores user‑supplied shortcode attributes without adequate sanitization or escaping, creating a stored cross‑site scripting flaw. Authenticated contributors or higher can inject arbitrary JavaScript that runs when a visitor loads a page containing the injection, enabling session hijacking, data theft, or defacement.

WordPress sites using the Events Manager – Calendar, Bookings, Tickets, and more! plugin up to and including version 7.0.3 are vulnerable. All installations of these versions, regardless of site domain, are affected.

The CVSS score of 6.4 marks this vulnerability as moderate severity. The EPSS score of less than 1% indicates a very low likelihood of exploitation, and it is not listed in the CISA KEV catalog. Exploitation requires an authenticated contributor‑level or higher account; the attacker can embed malicious scripts in shortcode attributes that the plugin stores and serves to all visitors.