The EventON plugin for WordPress includes an improper neutralization of input that permits reflected cross‑site scripting. An attacker can craft a payload that is reflected by the plugin into a web page, enabling the execution of arbitrary JavaScript in the victim's browser. This flaw allows an attacker to hijack user sessions, steal cookies, deface the site, and potentially redirect users to malicious sites.

The vulnerability affects the EventON plugin developed by ashanjay, versions from the earliest releases through 4.9.12 inclusive. All installations of these versions deployed on WordPress sites are potentially exposed unless the plugin is removed or upgraded.

The CVSS score is 7.1, indicating a high severity. The EPSS score is less than 1%, indicating a very low probability that the vulnerability will be exploited in the near term. The plugin is not listed in the CISA KEV catalog. The likely attack vector is through crafted input parameters that are echoed by the plugin in the generated HTML response. Successful exploitation requires user interaction, such as clicking a malicious link or visiting a page that contains the crafted query parameters.