The vulnerability is a basic cross‑site scripting flaw caused by improper neutralization of script‑related HTML tags. An attacker can insert arbitrary JavaScript into content handled by the WpEvently plugin, leading to execution in the browsers of visitors or administrators. This can compromise user sessions, steal credentials, or deface the site. The weakness is classified as CWE‑80.

The flaw affects the WordPress WpEvently plugin from Magepeople Inc. Versions up to and including 5.7.9 are vulnerable. Any WordPress installation using these plugin versions is at risk.

The CVSS score of 5.3 indicates a moderate impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation. Based on the description, it is inferred that the likely attack vector involves input fields within the plugin that are rendered without proper sanitization, allowing an attacker to inject scripts that run in the context of legitimate users. Consequently, the risk is moderate to high for sites that do not restrict admin access or that expose the plugin content to visitors.