Event Rsvp And Simple Event Management
Monthly
Stored cross-site scripting in the Event RSVP and Simple Event Management Plugin for WordPress up to 4.1.0 allows authenticated attackers with contributor-level permissions to inject arbitrary web scripts via the 'emd_mb_meta' shortcode. Injected scripts execute whenever any user accesses a page containing the malicious shortcode, potentially leading to session hijacking or unauthorized actions. No active exploitation or public exploit code has been identified, and EPSS score is very low (0.04%), indicating limited immediate risk.
Stored cross-site scripting in the Event RSVP and Simple Event Management Plugin for WordPress up to 4.1.0 allows authenticated attackers with contributor-level permissions to inject arbitrary web scripts via the 'emd_mb_meta' shortcode. Injected scripts execute whenever any user accesses a page containing the malicious shortcode, potentially leading to session hijacking or unauthorized actions. No active exploitation or public exploit code has been identified, and EPSS score is very low (0.04%), indicating limited immediate risk.