Improper neutralization of user input during page generation gives rise to a reflected XSS flaw. An attacker can embed malicious scripts in requests that are echoed back in the browser, enabling theft of session cookies, credential harvesting, or the execution of further attacks against site visitors. The flaw stems from a failure to properly escape or validate data received via query strings or form fields, allowing arbitrary script execution in the context of a legitimate user.

The vulnerability exists in the GoodLayers Goodlayers Hotel WordPress plugin with any version from its initial release up through 3.1.4. All sites that are running this plugin under those versions are susceptible until a fixed release is applied.

The CVSS score of 7.1 classifies this as a high‑severity flaw. The EPSS score of less than 1% indicates that, at this time, the likelihood of exploitation is low, and it is not listed in CISA’s KEV catalog. Attackers can exploit the flaw simply by crafting a malicious URL or form submission that includes a script payload; authentication is not required. Because the vulnerability is reflected, the impact is typically limited to visitors of the affected site, but the damage can be significant if the site hosts sensitive data or if users perform privileged actions after the injection.