The Bookalet WordPress plugin contains an improper neutralization of input during web page generation that allows stored cross‑site scripting (XSS). The vulnerability enables an attacker to inject malicious scripts that are persisted and subsequently rendered in the site’s output, potentially leading to session hijacking, defacement, or the execution of client‑side code in victims’ browsers. This flaw is classified as CWE‑79.

The issue affects the Bookalet plugin for WordPress, versions n/a through 1.0.3. Users running any of these releases on their WordPress installations are vulnerable.

The severity level, as reflected by a CVSS score of 6.5, indicates a moderate risk. The EPSS score of less than 1% suggests a low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via user‑generated content or plugin input that is stored and later rendered without proper sanitization, allowing an attacker to inject malicious code into the site’s output.