The vulnerability arises from improper input neutralization within the Events Calendar plugin, allowing an attacker to store malicious scripts that are later executed in victims’ browsers. This stored XSS flaw can lead to session hijacking, credential theft, or defacement when a victim views a page that renders the malicious content. The weakness is categorized as CWE‑79, indicating that user-supplied data is reflected without adequate sanitization.

The flaw affects Liquid Web / StellarWP The Events Calendar plugin versions through 6.18.1, including all preceding releases where the default event creation and editing interfaces accepted user‑controlled input. The scope extends to any WordPress site hosting these plugin versions, regardless of network segmentation, as the stored code is served directly to visitors of the site.

The CVSS score of 6.5 reflects that exploitation requires providing crafted input that is stored and subsequently rendered in the browser; privileged or administrative users must create or edit calendar events for the payload to persist. The EPSS score is not available, making it unclear how often this is being attempted, but the lack of a KEV listing suggests no widespread exploitation has been documented. Nevertheless, the stored nature of the payload means a successful injection can affect any user who views the compromised event pages.