The CP Multi View Events Calendar plugin for WordPress contains a stored cross‑site scripting flaw in the 'Subject' parameter. Insufficient input sanitization and output escaping enable attackers who are authenticated with Subscriber‑level or higher privileges to insert arbitrary JavaScript. When any user views a page containing the injected event, the malicious scripts execute, allowing session hijacking, cookie theft, or defacement. This is a classic XSS vulnerability identified as CWE‑79.

The flaw affects installations of the Codepeople CP Multi View Events Calendar plugin version 1.4.43 and all earlier releases. WordPress sites that have this plugin activated and allow users with Subscriber or higher rights to create or edit events can trigger the vulnerability. The injected payload is stored in the plugin’s JavaScript calendar code and the datafeed endpoint that accepts the 'Subject' value, meaning every site running an affected version is exposed.

The CVSS score of 6.4 indicates a moderate severity that still represents significant risk to user session confidentiality and integrity. No EPSS data is available, and the issue is not listed in the CISA KEV catalogue, implying that widespread exploitation has not been observed. Attackers must be authenticated with at least Subscriber privileges, but they can reach the vulnerable endpoint from any published page that includes the calendar shortcode, so any typical WordPress site with an affected plugin and subscriber users is a potential target.