Improper neutralization of user input in ThimPress WP Hotel Booking allows a DOM‑Based Cross‑Site Scripting vulnerability. An attacker who can influence the content of the affected page could inject malicious JavaScript that executes in a victim’s browser. This could lead to credential theft, defacement, or session hijacking for site visitors or administrators.

All installations of the WP Hotel Booking plugin developed by ThimPress, from the earliest available revision through version 2.2.8, are vulnerable. No specific sub‑version information is provided beyond the upper bound of 2.2.8.

The CVSS score of 5.9 indicates a moderate severity. The EPSS score is less than 1 %, suggesting a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, implying no confirmed exploits at the time of this analysis. Based on the description, the likely attack vector is a DOM‑Based XSS that requires the attacker to inject input that is rendered on the client side, possibly through form fields or URL parameters. No network‑level access is required, and the impact is limited to the browser running the affected page.