The Vulnerability allows authenticated WordPress users with contributor or higher permissions to inject arbitrary JavaScript into pages via the Evenium plugin’s 'evenium_single_event' shortcode. The plugin fails to sanitize or escape user‑supplied shortcode attributes, meaning that malicious code injected during event creation is persisted and executed whenever the page is viewed. This can lead to session hijacking, defacement, or other client‑side attacks against site visitors, compromising confidentiality and integrity of user data.

All installations of the Evenium WordPress plugin version 1.3.11 or earlier are affected. The vulnerability exists in the plugin’s shortcode handling, which is part of the WordPress content editing interface. Users of these plugin versions should be aware that any contributor‑level role can activate the attack vector.

The CVSS score of 6.4 denotes moderate severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Although exploitation requires authenticated access with contributor or higher privileges, the persistent nature of the stored script means that once injected it can impact all users who view the affected page.