The Events In City WordPress plugin suffers from a stored cross‑site scripting flaw (CWE-79) in its org_events shortcode. Insufficient input sanitization and output escaping cause attribute values such as organizer_id, width, height, transparency, header, border, and layout to be concatenated directly into HTML attributes without esc_attr(). As a result, an attacker can embed arbitrary JavaScript that will run whenever a user visits a page containing the injected shortcode. The script runs with the permissions of the browsing user, potentially allowing defacement, cookie theft, or other client‑side compromise.

WordPress sites that install the Events In City plugin in any version through 3.0, inclusive. Site administrators using these plugin versions are affected. The vulnerability exists anywhere the org_events shortcode can be placed, including posts, pages, or widgets.

The CVSS score of 6.4 indicates a moderate severity. Although an EPSS score is not provided, the lack of a KEV listing suggests the vulnerability has not yet been widely exploited publicly. The attack requires an authenticated user with contributor level or higher and the ability to insert or edit content containing the org_events shortcode. Once injected, the XSS payload executes for every visitor who views the affected page, making the vector effectively local but with a broad impact on all site users.