CVE-2024-6931 is a stored cross-site scripting vulnerability in the The Events Calendar plugin for WordPress, affecting all versions up to and including 6.6.3. The issue is due to improper neutralization of input in the RSVP name field, which allows unauthenticated attackers to inject arbitrary web scripts that execute in the context of users viewing the injected pages. This vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), indicating network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, and limited confidentiality and integrity impact without availability impact.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the context of users visiting the affected pages, potentially leading to information disclosure and integrity impacts such as session hijacking or unauthorized actions performed on behalf of the user. There is no indication of availability impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying temporary mitigations such as disabling or restricting the RSVP feature if feasible, or implementing web application firewall (WAF) rules to detect and block malicious input targeting the RSVP name field. Monitor vendor channels for updates and apply official patches promptly once released.