The vulnerability is an improper neutralization of input during web page generation that allows attackers to store malicious scripts in event data. When the event information is displayed on the site, the injected scripts run in visitors' browsers, potentially stealing session cookies, defacing content, or redirecting users to malicious pages. The weakness is classified as CWE‑79 and provides only client‑side damage without server‑side code execution.

The flaw affects WordPress The Events Calendar plugin versions up through 6.18.3. Site owners running any of those releases—at no minimum any version prior to 6.18.3.1—are vulnerable. The plugin is distributed by Liquid Web and StellarWP and is a common addition to WordPress installations that manage event listings.

The CVSS base score is 6.5, indicating moderate severity. No EPSS score is published, so the real‑world exploitation probability is unknown, and the vulnerability has not been listed in CISA’s KEV catalog. Attackers likely need write access to event content or the ability to create an event; a privileged user can inject scripts that persist in the database. Once injected, any visitor who views the event will have the malicious code executed, yielding client‑side impact.