The HotelRunner Booking Widget plugin for WordPress contains insufficient input sanitization and output escaping for attributes used in its 'hotelrunner' shortcode. This flaw allows authenticated users with contributor privilege or higher to inject malicious scripts that are stored and later executed whenever any site visitor accesses a page containing the shortcode, enabling phishing, session hijacking, or defacement. The weakness is categorized as CWE‑79, a typical stored XSS vulnerability with high potential for user‑impact.

All installations of the HotelRunner Booking Widget plugin, versions up to and including 5.2.4, are affected. The plugin is available from the WordPress plugin repository and can be installed on any WordPress site that utilizes the shortcode functionality.

The vulnerability carries a CVSS score of 6.4, indicating moderate severity, and an EPSS score of less than 1%, suggesting a very low likelihood of exploitation at this time. It is not listed in CISA's KEV catalog. The attack vector is authenticated: an attacker must have contributor‑level or higher access to create or edit content that incorporates the shortcode. Upon successful injection, any user viewing the affected page would execute the injected code. While the exploitation path is straightforward, the requirement for authenticated access limits the attack surface to sites with compromised contributor accounts or trusted users with elevated privileges.