The EventON-RSVP WordPress plugin before 2.9.5 does not sanitise and escape some parameters before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege us…
CVSS 3.1MEDIUM 6.1·Network·No auth·User interaction·EPSS 0.0042·Published 2024-01-22·Fixed in 2.9.5CWE-79