The vulnerability is an improper neutralization of input during web page generation that permits reflected cross‑site scripting attacks defined by CWE‑79. An attacker can inject malicious scripts when a crafted request is processed by the Form To Online Booking plugin, potentially compromising the browser session of any user who views the affected page.

The flaw affects the WordPress plugin Form To Online Booking, version 1.0 and earlier, released by Nabeel Tahir under the cf7‑calendly‑integration package. No other vendor or product versions were identified in the CNA data.

With a CVSS score of 7.1, the vulnerability is considered moderate to high severity. The EPSS score is below 1 %, indicating a low probability of exploitation in the wild, and the issue is not listed in the CISA KEV catalog. The likely attack vector is reflected XSS via crafted URLs or form submissions that include malicious script payloads; a successful exploit would lead to client‑side compromise, allowing data theft, session hijacking, or defacement without requiring authentication.