Pixelite’s Events Manager plugin for WordPress contains a reflected Cross‑Site Scripting vulnerability in all versions up to and including 7.4.2. An attacker can inject malicious JavaScript into a page that displays event details or other plugin‑managed content. When a user views the affected page, the injected script runs with the privileges of the visitor’s browser, enabling cookie theft, session hijacking, defacement, or other client‑side attacks. The weakness is classified as CWE‑79 and was scored with a CVSS of 7.1, indicating a high potential for damage to confidentiality and integrity.

Affected products are the Events Manager WordPress plugin from Pixelite, version 7.4.2 and earlier. No other versions are marked as vulnerable in the provided data.

Based on the description, it is inferred that the vulnerability is unauthenticated and does not require any special privileges; exploitation can be performed by any visitor to a site running the vulnerable plugin. The EPSS score of less than 1% indicates a very low but non‑zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 7.1 indicates a high risk, and because the weakness is client‑side XSS, successful exploitation depends on user interaction, typically by clicking a link or visiting a crafted event URL.