The WPBookit plugin contains a stored cross‑site scripting flaw caused by the lack of a capability check in the save_custome_code() function. Externally supplied data passed via the css_code parameter is persisted and rendered without proper sanitization, allowing an unauthenticated attacker to inject arbitrary JavaScript that will execute whenever a user views a page using the affected code.

WordPress sites running the WPBookit plugin from iqonicdesign, any version up to and including 1.0.6, are affected.

With a CVSS score of 7.2 the vulnerability is classified as high severity. The EPSS score is below 1%, indicating a low current exploitation probability, and the condition is not present in the CISA KEV catalog. Attackers do not need any authentication or elevated privileges; they simply supply malicious content in the css_code field, which is then stored and later rendered to all site visitors. The tendency to remain unauthenticated on affected sites puts all visitors at risk of executing injected scripts.