The vulnerability is a stored cross‑site scripting flaw in the WordPress Events Made Easy plugin. An unauthenticated attacker can submit a malicious string in the `event[location_name]` parameter when the site administrator has enabled the guest event submission and forced location creation options. Because the plugin fails to sanitize or escape this input before rendering it in event pages, the stored payload is executed in the browser of any user who visits the affected event page. The CVE description does not state specific outcomes; it is inferred that, like typical XSS, an attacker could steal session cookies, inject malicious content, or facilitate phishing.

Any WordPress installation using the Events Made Easy plugin up to and including version 3.2.22 is vulnerable. The vendor liedekef maintains versions 1.0–3.2.22; later releases from 3.2.23 onward contain the fix.

The flaw carries a CVSS score of 5.4, reflecting medium severity. EPSS below 1% denotes a low current exploitation probability, and it is not listed in the CISA KEV catalog. Exploitation requires that the administrator has explicitly enabled both the guest event submission and forced location creation settings, which default to off. No user authentication is required for attackers; the stored payload is triggered simply by a victim visiting the infected event page.