The BookingPress plugin for WordPress suffers from a DOM‑based Cross‑Site Scripting flaw due to improper neutralization of user‑supplied input during page generation. An attacker can craft input that the plugin includes in a rendered page, enabling the execution of arbitrary JavaScript in the context of the victim’s browser. This permits credential theft, session hijacking, defacement, or delivery of further malware to users who view the affected pages.

WordPress sites using the BookingPress appointment‑booking plugin version 1.1.25 or earlier are vulnerable. The issue applies to all releases from the first release up to and including 1.1.25. Sites that have upgraded to a later version are not affected.

The CVSS v3.1 score of 6.5 places the issue in the medium‑severity range, and the EPSS score of less than 1 % indicates a low probability of exploitation at this time. The vulnerability is Browser‑based, requiring the victim to load a crafted URL or interact with a page that reflects the malicious input. While the immediate risk is moderate, any exposed user could trigger the XSS without authentication, making the flaw highly useful for malicious actors. The vulnerability is not listed in CISA’s KEV catalog, so no publicly confirmed active exploitation is documented.