A stored XSS flaw exists in the codepeople Booking Calendar Contact Form plugin, allowing an attacker to inject malicious script into fields that are rendered as part of a web page. When other users view the affected page, the injected script executes with the privileges of the visiting user, enabling credential theft, session hijacking, or site defacement. The vulnerability stems from insufficient input sanitization when storing user input.

The affected product is the codepeople Booking Calendar Contact Form plugin for WordPress, versions from unknown earlier releases through 1.2.58. Users running these plugin versions on any WordPress site are susceptible.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attacks would likely target exposed form fields that any website visitor can interact with; no privileged credentials are required to inject the payload.