The Themify Event Post plugin versions up to 1.3.4 suffer from a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This allows an attacker with limited privileges and requiring user interaction to inject malicious scripts that can execute in the context of other users, potentially leading to partial confidentiality, integrity, and availability impacts. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with scope changed and low impacts on confidentiality, integrity, and availability.

Successful exploitation can lead to stored XSS attacks, which may allow attackers to execute arbitrary scripts in the context of other users, potentially leading to partial disclosure of information, modification of data, or disruption of service. The impact is rated medium with limited confidentiality, integrity, and availability effects.

No official patch or remediation is currently documented for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict privileges to trusted users and consider disabling or limiting use of the Themify Event Post plugin to reduce exposure.