The Events Made Easy WordPress plugin contains a stored cross‑site scripting flaw that is triggered by the unsanitized 'width' attribute in its shortcode. The flaw allows an authenticated user with contributor-level permissions or higher to inject arbitrary JavaScript into the site’s content. Once injected scripts are executed in the browsers of any visitor who loads the affected page, a malicious actor can hijack user sessions, steal credentials, deface content, or load additional malware. This vulnerability is assigned to CWE‑79.

This issue affects all releases of the Events Made Easy plugin by liedekef through version 3.3.1, inclusive. WordPress sites that have not updated to a fixed version beyond 3.3.1 are potentially vulnerable. The plugin is commonly found on community, corporate, and event‑management WordPress installations that use the Events Made Easy shortcode for displaying event information.

The flaw carries a CVSS score of 6.4, indicating a moderate severity. Because the attacker must be authenticated at the contributor level, the exploitation window is limited to sites with poorly managed roles, but once access is obtained the impact is significant. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, yet the potential for widespread XSS attacks on multiple visitors makes it a high‑priority concern for any site that needs to be patched promptly.