The Events Listing Widget plugin stores the contents of the 'Event URL' field without proper sanitization or escaping, allowing an authenticated user with Author or higher privileges to inject arbitrary JavaScript. When a page that displays the injected event is loaded by any visitor, the malicious script executes in the visitor’s browser.

WordPress sites running the Events Listing Widget plugin by jackdewey, in all releases through version 1.3.4 are affected. Any installation that has not yet upgraded beyond 1.3.4 is vulnerable.

The base CVSS score of 6.4 indicates a moderate severity vulnerability; the EPSS score of less than 1% indicates a low probability of exploitation in the wild, and the vulnerability is currently not listed in CISA's KEV catalog. Exploitation requires the attacker to be authenticated with Author role or higher, after which they can edit an event to embed malicious code. Once injected, the script executes automatically for all users who view the event, making the attack local to the WordPress environment.