The Booking System Trafft plugin contains a stored XSS flaw that fails to neutralize user‑supplied input before rendering it into web pages. The weakness, labeled CWE‑79, permits an attacker to inject and execute arbitrary JavaScript in the browsers of any visitor who views the affected content, potentially enabling session hijacking, defacement, or malicious downloads.

Any WordPress site that uses the ameliabooking Booking System Trafft plugin version 1.0.14 or older is affected. The vulnerability applies to all installations that have not been updated beyond that version, whether the plugin was obtained from the WordPress repository or directly from ameliabooking.

The CVSS score of 6.5 reflects a moderate‑to‑high level of risk. The EPSS score of less than 1 % indicates a low probability of exploitation at present, and the issue is not listed in the CISA KEV catalog. Because the flaw is a stored XSS that can be triggered via input accepted by the plugin, an attacker could compromise site visitors without needing authentication, making it a notable concern for site administrators.