The Event RSVP and Simple Event Management Plugin for WordPress contains a stored cross-site scripting vulnerability identified as CVE-2025-5540. This vulnerability is due to improper neutralization of input during web page generation (CWE-79) in the 'emd_mb_meta' shortcode. Authenticated attackers with contributor-level privileges or higher can inject arbitrary scripts that persist in the plugin's output, leading to script execution in the context of users who access the compromised pages. The vulnerability affects all plugin versions up to and including 4.1.0. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and impacts on confidentiality and integrity but not availability. No vendor-provided patch or advisory is currently available, and no known exploits have been reported.

Successful exploitation allows authenticated users with contributor or higher privileges to inject persistent malicious scripts into pages generated by the plugin. This can lead to unauthorized actions performed in the context of other users viewing the affected pages, potentially compromising confidentiality and integrity of user data. The vulnerability does not affect availability. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the affected plugin if feasible. Monitor official vendor channels for updates regarding patches or mitigations.