The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress contains a stored cross‑site scripting flaw caused by insufficient sanitization of the 'new_event_type_background_color' parameter. When malicious script is entered into this field, it is persisted in the database and rendered on any visitor to the affected pages. The vulnerability allows an attacker to inject arbitrary web scripts that will run during subsequent page views, potentially compromising the integrity of content displayed to users.

WordPress sites using the Metagauss EventPrime plugin up to version 4.3.4.2 are vulnerable. Exploitation requires that the Guest Submissions setting (allow_submission_by_anonymous_user) is enabled for unauthenticated users to create event types, or that a subscriber‑level or higher authenticated user is able to submit event types via the front‑end form.

The CVSS score of 7.2 designates a high severity issue. The EPSS score, which is below 1%, indicates a very low probability of exploitation at the time of analysis. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is the plugin’s front‑end event‑type form; authenticated or unauthenticated users who can submit event types may inject the malicious payload. When guest submissions are disabled, an attacker still needs at least a subscriber‑level account, reducing but not eliminating the risk.