The vulnerability is a classic reflected XSS flaw that allows an attacker to inject malicious script code into the web pages generated by the reservation plugin. When a malicious URL or input is processed by the plugin and returned unescaped to the browser, the attacker can steal session cookies, hijack the user’s session, or deface the site. The weakness is a classic input validation flaw (CWE‑79).

DesignThemes’ WordPress Reservation Plugin (dt-reservation-plugin), any installation of version 1.6 or earlier is affected. The flaw applies to all users who load the plugin’s web pages.

The CVSS score of 7.1 indicates a high severity, while the EPSS score of less than 1% shows a low probability of exploitation at present. The flaw is not listed in the CISA KEV catalog. The likely attack vector is the web; a crafted URL or form submission can trigger the reflected XSS and cause arbitrary JavaScript execution in the victim’s browser. Because the flaw is user‐exposed, any traffic to the affected site can be exploited by an attacker who succeeds in getting a victim to visit a malicious link.