The vulnerability is a CSRF flaw that permits an attacker to inject malicious script into the WooCommerce Booking Bundle Hours plugin. When a logged‑in user submits a crafted request, the plugin stores the attacker‑controlled payload in its database. Any visitor who views the affected content will then execute the embedded script, which can be used to hijack sessions, deface the site, or load additional malware. This is characteristically a stored XSS attack enabled through CSRF, classified as CWE‑352.

All installations of the WooCommerce Booking Bundle Hours plugin version 0.7.4 and earlier are affected. Site administrators should confirm the installed version and upgrade to at least 0.7.5, as the author’s patch removes the CSRF and stored XSS flaw.

The CVSS score of 7.1 indicates high severity, but the EPSS score of less than 1% shows a very low likelihood of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Attackers must craft a CSRF request that a logged‑in user submits; once executed, the stored XSS payload is presented to all users who view the content, potentially exposing credentials or delivering further malware. The overall risk is moderate, contingent on user authentication and specific request behavior.