Subscriber Cross Site Scripting vulnerability is present in EventON plugin versions 2.5.7 and older. The flaw allows an attacker to inject malicious JavaScript into the event interface, which will execute in the browser context of any user visiting the compromised page. This can lead to theft of credentials, defacement, or unauthorized actions performed on behalf of the victim. The weakness is classified as CWE‑79.

The affected product is the WordPress EventON plugin developed by Ashan Perera. Versions up to and including 2.5.7 are impacted. Any WordPress site running these versions without further mitigation is at risk.

The CVSS score of 6.5 indicates a moderate severity. EPSS data is not available, but the vulnerability is not listed in the CISA KEV catalog, suggesting no widely documented exploits yet. The likely attack vector is through the event creation or editing interface where untrusted input is reflected in the page. An attacker who can submit event data—whether via an authenticated account or a publicly reachable interface—could embed malicious scripts that execute for all viewers of the event.