The vulnerability is a stored Cross‑Site Scripting (XSS) flaw in the Themify Event Post plugin, allowing attackers to inject malicious scripts that are rendered by the browser when users view event posts. This can lead to theft of user credentials, session hijack or execution of arbitrary client‑side code, compromising confidentiality and integrity of user data. The weakness is identified as CWE‑79 – Improper Neutralization of Input During Web Page Generation.

The flaw affects installations of the Themify Event Post plugin made by the vendor themifyme. Any WordPress site running the plugin through version 1.3.4 or earlier is vulnerable. No additional affected versions are listed, so only the stated range is impacted.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of less than 1% shows a low probability of exploitation in the current marketplace, and the vulnerability is not listed in CISA’s KEV catalog. Abuse likely requires access to the site’s administrative interface or the ability to create or edit an event post, after which the injected payload is stored and served to visitors. Attackers would need to craft a malicious script and submit it as part of an event post, which then propagates to every visitor of that post.