The Event Booking Manager for WooCommerce plugin prior to version 5.3.7 fails to sanitize or escape event timeline content submitted by users with post-editing privileges. This allows users with the Author role or above to inject arbitrary JavaScript code that executes in the browsers of any visitor viewing the affected event page, including administrators. The vulnerability is classified as CWE-79 (Cross-Site Scripting).

Successful exploitation can lead to execution of arbitrary JavaScript in the context of the affected website, potentially allowing attackers to perform actions on behalf of other users, steal session tokens, or conduct other malicious activities within the browser session of visitors, including administrators. The CVSS score is 5.4 (medium severity), reflecting limited privileges required (Author role) and user interaction needed.

No official patch or remediation level has been confirmed yet. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict post-editing access to trusted users only and consider disabling or limiting the use of event timeline content features that accept user input. Monitor vendor channels for updates and apply official patches once released.