The plugin fails to escape event titles in the ticket history log, allowing any user with the Editor role or higher to inject JavaScript into a title. As the title is later rendered for higher‑privileged users on a multisite installation, the script executes in their browser context, creating a stored cross‑site scripting flaw (CWE‑79).

The flaw exists in all releases of the Event Tickets and Registration WordPress plugin prior to version 5.28.4. Any WordPress site using that plugin on a multisite network and assigning Editor or higher roles is potentially vulnerable. Versions beyond the <5.28.4 threshold are not specified, but any older release satisfies the condition.

The CVSS score of 3.5 indicates low severity, and the EPSS score is below 1%, suggesting exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to have an Editor‑level login and to add a malicious title; once stored, the attack vector becomes a stored XSS that can impact users with higher privileges across the multisite network.