The vulnerability resides in the WP Event Solution plugin for WordPress, affecting versions up to 4.1.26. An attacker can inject malicious JavaScript that is stored by the plugin and later served to users. If successful, the injected script could steal cookies, hijack sessions, alter page content, and potentially gain control over the victim’s browser context. This stored cross‑site scripting delivers direct impact on confidentiality and integrity of user data and can lead to further exploitation such as phishing or credential theft. The known weakness is documented as CWE‑79.

The plugin is distributed by Arraytics and is known as WP Event Solution. All installations running version 4.1.26 or earlier are vulnerable; the situation applies to every instance where the plugin is enabled within a WordPress environment.

The CVSS score of 7.1 places the issue in the high‑severity category. Because the EPSS score is not available, the current probability of exploitation is unclear, yet the absence of a KEV entry suggests no known widespread exploitation at this time. Based on the stored XSS nature, the likely attack vector is via a web form or administrative interface that the plugin uses; this inference is drawn from the common path of such vulnerabilities and is not directly stated in the description.