The vulnerability is an Improper Neutralization of Input During Web Page Generation that allows attackers to inject arbitrary script code into the site. Because the payload is stored, any compromised user or attacker can cause malicious scripts to run whenever that content is displayed, potentially enabling session hijacking, theft of credentials, or defacement. The weakness is identified as CWE‑79 and could be exploited to compromise the confidentiality and integrity of affected WordPress sites.

AvaiBook plugin version 1.2 or earlier on WordPress installations is affected. Sites that have not upgraded beyond 1.2 are at risk.

The CVSS score of 5.9 indicates moderate severity, and the EPSS score of less than 1% shows a low current probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via the plugin’s data entry or management interface, where user supplied data is stored and later rendered. While the attack requires a platform that accepts user input, the stored nature means a successful injection can affect all individuals who view the content.