Hi.Events versions prior to 1.11.0 contain a cross‑site scripting flaw that allows an authenticated user with permission to create or edit events to embed arbitrary HTML and JavaScript through an event title. When the title includes the sequence </script>, the content is not properly escaped by JSON.stringify() before being placed inside inline the injected code is executed in the browser of anyone who views the public event page, including unauthenticated visitors and administrators.

All releases of Hi.Events from HiEventsDev prior to version 1.11.0, including the 1.10.x series

The vulnerability has a CVSS score of 5.1 and an EPSS score of less than 1%, indicating a low but non‑zero probability of exploitation. It is not listed in the CISA KEV catalog. Attackers must be authenticated with event creation or edit rights to inject malicious titles, after which any user who views the event page will be exposed to the malicious script. The weakness, classified as CWE‑862, arises from insufficient input validation of stored fields that are later rendered in a script context.