An unauthenticated reflected Cross‑Site Scripting flaw exists in the WordPress Eventer plugin up to version 0.1.1. The vulnerability allows an attacker to inject malicious script into a victim’s browser, potentially leading to session hijacking, defacement, or further exploitation of the user’s browser context. The weakness is a classic input validation failure identified as CWE‑79.

The affected product is the Eventer plugin by Jyothis Joy. All installations of Eventer versions 0.1.1 and earlier are impacted.

The CVSS score of 7.1 indicates a high impact severity for this XSS flaw. No EPSS score is available, so the current exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw by crafting a malicious URL that a victim clicks or by embedding the payload in a social engineering context. Upon execution, the attacker can run arbitrary JavaScript with the privileges of the victim’s browser session.