The vulnerability is a Stored Cross‑Site Scripting flaw that occurs when the Beds24 Online Booking plugin does not properly neutralize user input before rendering it in web pages. This flaw can allow an attacker to inject arbitrary JavaScript that will be executed in the browsers of any user who views the affected content, potentially leading to session hijacking, credential theft, or distribution of malware. The weakness is identified as CWE‑79, a classic input validation issue.

The Beds24 Online Booking plugin for WordPress, developed by markkinchin, is affected in all releases up to and including version 2.0.29. The vulnerability is present in the plugin’s handling of user‑supplied data that is later persisted and displayed on the site.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of widespread exploitation at present. The vulnerability is not currently listed in CISA’s KEV catalog. Exploitation requires the attacker to be able to insert malicious input into the plugin’s data fields, which is typically feasible for authenticated users with sufficient privileges or via crafted requests sent to the application. Once the malicious payload is stored, it will execute in the context of any user who loads the affected page.