The EventPress theme does not sanitize or escape the 'id' parameter supplied to the eventpress_customizer_notify_dismiss_action AJAX handler. The unsanitized value is reflected back in the response, allowing unauthenticated attackers to inject malicious scripts that execute in the browsers of logged‑in users. This flaw is a reflected Cross‑Site Scripting (XSS) vulnerability and represents a direct threat to the confidentiality and integrity of user sessions.

The vulnerability affects installations of the EventPress WordPress theme version prior to 22.2. All users running EventPress 22.1 or earlier are susceptible to this XSS when the customizer dismiss action is triggered.

There is no EPSS score or KEV listing for this issue, but reflected XSS is a well‑known vector that can be leveraged simply by sending a crafted request to the vulnerable AJAX endpoint. Because the flaw does not require authentication, any external actor can embed malicious payloads and cause the script to run in the context of logged‑in visitors. No additional conditions beyond the presence of the unescaped 'id' parameter are required, making exploitation straightforward.