The Events Manager plugin for WordPress contains an unauthenticated Cross Site Scripting vulnerability in all versions up to and including 7.4.1. An attacker can inject malicious JavaScript into a page that displays event details or other plugin‑managed content. When a user views the affected page, the injected script runs with the privileges of the visitor’s browser, enabling cookie theft, session hijacking, defacement, or other client‑side attacks. The weakness is classified as CWE‑79 and was scored with a CVSS of 7.1, indicating a high potential for damage to confidentiality and integrity.

Affected products are the Events Manager WordPress plugin, version 7.4.1 and earlier, produced by @msykes:Events Manager. No other versions are marked as vulnerable in the provided data.

The vulnerability is unauthenticated and does not require any special privileges; exploitation can be performed by any visitor to a site running the vulnerable plugin. The EPSS score is not available, so the likelihood of exploitation cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 7.1 indicates a high risk, and because the weakness is client‑side XSS, successful exploitation depends on user interaction, typically by clicking a link or visiting a crafted event URL.