Technical impact
The vulnerability is a reflected cross‑site scripting flaw in the Pixelite Events Manager WordPress plugin. User input is improperly neutralized during web page generation, enabling an attacker to inject malicious JavaScript that is executed in the browser of any user who views a page containing the forged input. This can lead to theft of session cookies, credential hijacking, defacement of the site, or the execution of additional malicious code.
Affected Systems
Affects the Pixelite Events Manager plugin for WordPress from its earliest release through version 7.4.8. Any WordPress installation running an affected version of the plugin is vulnerable and requires an upgrade to at least 7.4.9.
Risk and Exploitability
The CVSS score of 7.1 categorizes this flaw as a high‑severity vulnerability. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, so publicly known exploitation risk is uncertain. The likely attack vector is a web browser; an attacker must supply a crafted input—such as a URL containing a malicious query string or form data—to trigger the reflected script. Successful exploitation requires a victim to load the crafted page in their browser, after which the injected script runs with the victim’s privileges.
