The vulnerability resides in the Eventin plugin for WordPress when handling the 'etn_faq_content' field. Because the plugin does not sanitize or escape the stored content, a contributor or higher privileged user can store malicious JavaScript. When the event page is viewed, the unsanitized payload is rendered, allowing the attacker to execute arbitrary scripts in the context of every site visitor.

All WordPress installations that have the Eventin plugin version 4.1.15 or earlier are affected. The weakness exists in the FAQ editing functionality, where the 'etn_faq_content' parameter is accepted. Sites using any of the earlier releases of the plugin should verify their plugin version and upgrade accordingly.

The CVSS score of 6.4 indicates moderate severity, and the EPSS score of less than 1 % suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalogue. Attackers need authenticated access with contributor‑level permissions to inject payloads, and the stored script is executed on every page view by end users, borrowing the site’s domain as the attack context. This limited attack surface reduces the likelihood of large‑scale impact, but a compromised user or automated malware could still carry out malicious actions.