The WP Event Manager plugin for WordPress contains a stored XSS vulnerability due to improper neutralization of input during web page generation. The 'tag-name' parameter is not properly sanitized or escaped, allowing authenticated administrators to inject malicious scripts. These scripts execute when any user accesses the affected page. The vulnerability only affects multi-site setups or installations with unfiltered_html disabled. No known exploits are reported in the wild. The CVSS vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, and partial confidentiality and integrity impact without availability impact.

An authenticated attacker with administrator privileges can inject arbitrary web scripts via the 'tag-name' parameter, which will execute in the context of users visiting the affected pages. This can lead to partial compromise of confidentiality and integrity of user data within the affected WordPress environment. The vulnerability does not affect availability and requires high privileges and specific WordPress configurations (multi-site or unfiltered_html disabled). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit administrator access to trusted users only and consider disabling multi-site features or enabling unfiltered_html capability if appropriate. Monitor vendor channels for updates and apply patches promptly once released.