The vulnerability is an improper neutralization of script‑related HTML tags in the Events Calendar plugin. It allows an attacker to inject malicious script content that will be executed in the browser of anyone who views the affected page. The impact is the execution of arbitrary JavaScript, which can lead to data theft, session hijacking, or defacement of the website. This flaw is a classic Cross‑Site Scripting weakness, classified as CWE‑80.

The issue affects installations of the Events Calendar plugin from the earliest versions up through 6.18.3, most commonly found on WordPress sites using Liquid Web / StellarWP. Any site running a version of this plugin equal to or lower than 6.18.3 is potentially vulnerable.

The publicly available CVSS score of 5.3 indicates moderate severity. The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog, suggesting that active exploitation may not yet be widespread. Based on the description, the attack vector is inferred to involve submitting malicious input through the plugin’s content fields, so the required skill level is moderate and no special privileges are needed. The risk remains significant if an attacker can inject script code that will run in the context of authenticated users or will be displayed to untrusted visitors.