The Event Tickets, RSVPs, Calendar plugin for WordPress contains an input validation flaw that allows an authenticated user with contributor privileges or higher to inject arbitrary JavaScript into pages using the plugin’s ‘ticket_spot’ shortcode. The injected script is stored within the post or page content and will execute automatically whenever any user visits the impacted page, potentially enabling credential theft, session hijacking, defacement, or data exfiltration. The weakness is a classic stored cross‑site scripting flaw, classified as CWE‑79.

The vulnerability affects the TicketSpot Event Tickets, RSVPs, Calendar plugin for WordPress in all versions up to and including 1.0.2. Sites running any of those releases are impacted, regardless of the number of websites or WordPress installations they host.

The CVSS score of 6.4 indicates a moderate severity, but the EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting a low but non‑zero probability of exploitation. Because the attack requires authenticated contributor access, it is a local privilege escalating risk rather than a remote exploit. If an attacker gains a contributor account, they can inject scripts that will affect every subsequent visitor of the affected page, thereby creating a widespread impact within the site’s user base.