The vulnerability is a stored cross‑site scripting flaw in the Events Made Easy WordPress plugin. An unauthenticated attacker can inject JavaScript into the 'event[location_name]' field when the admin has enabled the guest event submission and forced location creation options. When a victim browses a page displaying the event, the injected script runs, allowing the attacker to steal the victim’s session cookies, perform phishing attacks, or modify page content.

The flaw affects all versions of the Events Made Easy plugin released up to and including 3.2.22. No other plugin versions are impacted.

The flaw carries a CVSS score of 5.4, indicating medium severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that a site administrator has enabled both the guest event submission (eme_fs[guest_submit]) and forced location creation (eme_fs[force_location_creation]) settings, which default to off. Because the attack does not need any authentication and the payload is stored persistently, it can be triggered by any user who views a maliciously crafted event page.