The vulnerability resides in the XO Event Calendar WordPress plugin’s obfuscated handling of the 'xo_event_field' shortcode. When attributes are passed to the shortcode, the plugin fails to sanitize or escape them properly, allowing an attacker to persistently inject malicious scripts. The injected payload is stored in the database and will execute whenever any site visitor loads the affected page, potentially compromising session data, hijacking accounts, or defacing content. The flaw is a classic Stored XSS (CWE‑79).

This issue affects the XO Event Calendar plugin from ishitaka, in all releases up to and including version 3.2.10. Any WordPress site installing this plugin without an update fall under the risk envelope.

The CVSS score is 6.4, indicating moderate severity, while the EPSS score is less than 1 %, suggesting a low current exploitation probability, and it is not listed in the CISA KEV catalog. The likely attack vector requires an authenticated contributor or higher to inject the payload via the shortcode attribute; once stored, the XSS triggers for any user that views the affected content. If the site’s user base is large or contains sensitive data, the potential impact escalates markedly.