This vulnerability arises from an improper neutralization of input during page generation in the WP Chill RSVP and Event Management plugin, allowing attackers to inject malicious scripts that are stored and then executed in the browsers of any users who view the affected content. The injection can be used to hijack sessions, deface pages, or facilitate phishing attacks, compromising the confidentiality and integrity of user interactions with the site.

The issue affects the WP Chill:RSVP and Event Management plugin for all releases through version 2.7.17. Versions newer than 2.7.18 are not affected.

The CVSS score of 7.1 indicates a high severity, while the absence of an EPSS score and no listing in the KEV catalog suggest that the exploitation likelihood is not yet quantified. The static, web‑based attack vector is inferred from the provided description; exploitation would involve crafting malicious input in the plugin's event or RSVP form, which is then stored and executed for any site visitor.