This vulnerability in the XT Event Widget for Social Events (versions up to 1.1.7) arises from improper validation of filenames used in PHP include or require statements, resulting in a Local File Inclusion (LFI) flaw. The CVSS 3.1 score is 7.5, indicating a high severity with network attack vector, high attack complexity, low privileges required, no user interaction, and impacts to confidentiality, integrity, and availability. The vulnerability could allow an attacker to include unintended files on the server, potentially leading to information disclosure or code execution depending on the context. No known exploits in the wild have been reported, and no patch or mitigation guidance is currently documented.

An attacker with low privileges could exploit this vulnerability remotely to include local files on the server, potentially leading to disclosure of sensitive information, modification of data, or disruption of service. The high CVSS score reflects significant potential impact on confidentiality, integrity, and availability of the affected system. No known active exploitation has been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable widget and applying any recommended configuration changes from the vendor. Monitor vendor channels for updates and apply patches promptly once released.