This vulnerability is a stored cross‑site scripting flaw. The plugin fails to sanitize event timeline content submitted by users with post‑editing access before storage and public rendering. The flaw allows any author or higher role user to embed arbitrary JavaScript that will execute in the browsers of all visitors, including site administrators, when they view the affected event page.

Affected systems are installations of the Event Booking Manager for WooCommerce WordPress plugin, version 5.3.6 and earlier. The vulnerability is present in all releases before 5.3.7 regardless of configuration, as the sanitization step is hard‑coded. Site owners using these unpatched versions are exposed.

The risk is moderate. The CVSS score of 5.4 reflects the stored nature of the XSS and the impact on confidentiality, integrity and availability of the affected website. The EPSS score of <1% indicates a low overall exploitation probability, yet authors or administrators can inject malicious scripts, potentially hijacking user sessions, defacing content, or delivering malware. The vulnerability is not listed in CISA KEV, and no public exploit is known. Attackers require author or administrator privileges to inject content, which is a typical permission level for managing event data.