This vulnerability in WPMinds Simple WP Events (<= 1.8.17) allows stored cross-site scripting due to improper input neutralization during web page generation. An attacker with low privileges can inject malicious scripts that execute in the context of other users, potentially leading to limited confidentiality, integrity, and availability impacts. The vulnerability requires user interaction and affects the plugin when used in WordPress environments.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of users viewing affected pages, potentially leading to information disclosure, session hijacking, or other impacts consistent with stored XSS. The CVSS vector indicates low attack complexity, low privileges required, and user interaction needed, with limited impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting plugin usage or applying manual input sanitization if feasible. Monitor vendor channels for updates and apply patches promptly once released.