An improper neutralization of input during web page generation allows stored cross‑site scripting in the Booking Calendar plugin, which can cause injected scripts to be rendered when booking information is displayed.

The vulnerability affects all installations of the wpdevelop Booking Calendar plugin running version 10.14.7 or earlier; newer releases are not impacted.

The CVSS score of 6.5 indicates moderate to high severity, while the EPSS score below 1% suggests a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector involves creating or editing a booking entry with malicious input; the offending script is then stored and executed for any user that later views that booking. Exploitation requires the ability to write booking content, so full site control is not mandatory.