The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress contains a flaw in the "header_format" parameter that allows arbitrary scripts to be reflected into a page when the search_events_grouped AJAX action is called. The parameter is not sanitized for this action, and the value is echoed directly into the HTML body by the output_grouped() function. An unauthenticated attacker can exploit this by constructing a link that a user clicks, leading to the execution of the injected script in the victim's browser. The weakness is a typical reflected XSS (CWE‑79) that can compromise the confidentiality, integrity and availability of the web session and can be used for phishing or other exploitation after a user is lured to a malicious URL.

All installations of the Events Manager plugin for WordPress that are at version 7.4.0.1 or earlier are vulnerable. This includes versions 7.4.0.1, 7.3.x and any earlier releases. The plugin is distributed under the name "Events Manager – Calendar, Bookings, Tickets, and more!" and is commonly used in WordPress sites that provide event, booking or ticketing capabilities.

The CVSS score of 6.1 evaluates this as a moderate severity vulnerability. The EPSS score is not available, and it is not listed in CISA’s KEV catalog, indicating that, although exploit code may exist, widespread or coordinated exploitation has not been reported. The vulnerability is exploitable remotely via an unauthenticated web request and does not require privileges beyond the normal access level of a site visitor. A malicious link that triggers the vulnerable AJAX action will cause the reflected script to run in the user’s browser, giving the attacker the same context as the web session.