The vulnerability allows any authenticated user, such as a subscriber, to create a WordPress role from a supplied name without checking capability or nonce, and stores the name unsanitized. This results in stored cross‑site scripting that is executed when an administrator opens certain user‑management screens, thereby allowing the attacker to run arbitrary JavaScript in the administrator’s browser. The weakness is characterized by improper input validation and a missing authorization check, corresponding to CWE‑79.

WordPress plugins MDJM Event Management and Mobile Events Manager, version 1.7.8.7 or earlier, are vulnerable. These are non‑specifically identified vendors. The issue is limited to the plugins' role‑creation functionality within the WordPress administration interface.

The vulnerability scores a CVSS of 8, indicating high severity. No EPSS score is publicly available, and the vulnerability is not listed in the CISA KEV catalog. Attack requires an authenticated WordPress user with subscriber role privileges, and execution occurs when an admin visits a standard user‑management screen. The lack of a nonce or capability check simplifies exploitation for any logged‑in user, making the risk significant for sites that permit subscriber access to the WordPress dashboard.