Technical impact
Improper neutralization of input in the WordPress Events Made Easy plugin permits a reflected Cross‑Site Scripting vulnerability, enabling an attacker to inject and execute malicious scripts within a victim’s browser. The injected code can steal session cookies, deface the page, or perform arbitrary actions on the victim’s behalf, compromising confidentiality and integrity of the host site and its users.
Affected Systems
The vulnerability affects the Franky Events Made Easy plugin for WordPress, versions up to and including 3.3.5. All releases from the initial version through 3.3.5 are impacted; no post‑3.3.5 releases are affected.
Risk and Exploitability
With a CVSS score of 7.1 the vulnerability presents moderate to high risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the reflected XSS by directing users to a crafted URL or form input, without requiring authentication. Because the flaw is client‐side, exploitation requires user interaction but is otherwise straightforward, raising the practical risk for sites where the plugin is exposed to the public.
