Improper sanitisation of user input in Deetronix Booking Ultra Pro enables a reflected cross‑site scripting flaw. An attacker can exploit this by embedding JavaScript in request parameters that are echoed back in the generated web page. The injected script runs with the privileges of the victim user, potentially permitting session hijacking, credential theft, or defacement. This vulnerability is identified as CWE‑79 and carries a CVSS score of 7.1, indicating a medium‑to‑high risk for affected installations.

It affects the Deetronix Booking Ultra Pro plugin for WordPress, versions from the earliest release through 1.1.19. Users running any of these versions should verify the currently installed version and compare it with the latest available release.

The CVSS metric indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of widespread exploitation at this time. The vulnerability can be leveraged when a victim visits a crafted URL that contains unsanitised parameters, meaning that the attacker must first entice a target to click a malicious link or email. The flaw is not listed in CISA’s Known Exploited Vulnerabilities catalogue, which further signals limited exploitation activity observed publicly.