This flaw is an improper neutralization of user input when generating web pages, classified as a reflected cross‑site scripting vulnerability (CWE‑79). When an attacker supplies specially crafted data that is reflected in the plugin’s output without proper escaping, the data is executed as script in a victim’s browser. The result is that the victim can run arbitrary JavaScript in the context of the affected site, which may lead to session hijacking, theft of user data, or defacement of content.

WordPress sites running the ComMotion Course Booking System plugin version 6.1.2 or earlier are affected. The issue is present in all releases from the first version through 6.1.2.

The CVSS score of 7.1 indicates moderate‑to‑high impact, while the EPSS score of less than 1 percent suggests a low probability of exploitation at present. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that an attacker can exploit the flaw by crafting a malicious URL or form submission that includes the attack payload in a parameter that the plugin echoes back to the browser; no special privileges or authentication are required beyond normal browsing of the affected page.