The EventPrime plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to insufficient input sanitization and output escaping of ticket names. This allows unauthenticated attackers to inject arbitrary web scripts into pages that will execute when accessed by users. The vulnerability affects all versions up to 4.0.4.7 and requires that front-end users be able to submit new events with tickets. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, with low confidentiality and integrity impact and no availability impact.

Successful exploitation can lead to execution of arbitrary scripts in the context of users viewing the injected pages, potentially resulting in theft of user credentials, session tokens, or other sensitive information accessible via the browser. The vulnerability does not impact availability. Since the attack requires user interaction (visiting a maliciously crafted page), the risk is medium severity. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or disable front-end event submissions if possible to reduce exposure. Additionally, apply web application firewall (WAF) rules to detect and block suspicious input patterns related to ticket names. Monitor for updates from the vendor metagauss regarding patches or official mitigations.