The flaw is an improper neutralization of user input during web page generation, enabling reflected cross‑site scripting. An attacker can inject malicious JavaScript that is reflected back to the victim’s browser when a crafted request is executed, allowing the attacker to steal session tokens, deface content, or redirect users to phishing sites.

Magepeopleteam’s WpEvently "mage‑eventpress" WordPress plugin is affected for all releases from the initial version up through 5.1.4. The vulnerability persists in every installed instance that has not been upgraded beyond 5.1.4.

The CVSS score of 7.1 indicates a high severity level. Although no EPSS score is publicly available and the flaw is not listed in the CISA KEV catalog, the exploitability is straightforward: an attacker can craft a URL or form submission that triggers the reflected script on any user browsing the site. The attack vector is inferred to be through user‑controlled input in HTTP queries or form data that is directly echoed in the response.