The Events Manager plugin for WordPress (netweblogic) contains a stored cross-site scripting vulnerability (CWE-79) identified as CVE-2024-0614. This vulnerability exists due to improper neutralization of input during web page generation, specifically in admin settings. Authenticated administrators or higher can inject malicious scripts that execute when users access the affected pages. The issue affects multi-site setups or installations with unfiltered_html disabled. The CVSS 3.1 vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, and partial confidentiality and integrity impact. No patch or official fix information is available from the vendor, and no exploits are known in the wild.

An attacker with administrator-level permissions or higher can inject persistent malicious scripts into the plugin's admin settings, which execute in the context of users visiting the affected pages. This could lead to partial confidentiality and integrity compromise within the affected WordPress multi-site or restricted HTML environments. The vulnerability does not impact availability. Exploitation requires high privileges, limiting the attack surface to trusted users with elevated access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and consider monitoring for suspicious admin activity. Since the vulnerability requires administrator-level permissions and affects multi-site or unfiltered_html-disabled installations, limiting these configurations may reduce risk. No vendor-provided patch or workaround is currently documented.