The vulnerability is a reflected cross‑site scripting flaw resulting from improper neutralization of user input during web page generation. An attacker can embed malicious script payloads into specially crafted URLs or form inputs that are then executed in the browser of any victim who views the reflected content. This can lead to session hijacking, credential theft, defacement, or compromise of the client side. The weakness is identified as CWE‑79.

The Court Reservation plugin developed by webmuehle is affected in all releases up to and including version 1.10.13. No other vendors or product versions are listed as impacted.

The CVSS score of 7.1 classifies the vulnerability as high severity, while the EPSS score of less than 1 % indicates a low probability of exploitation at the time of assessment. Since the flaw is a reflected XSS, the attacker typically needs only to persuade a victim to visit a malicious URL or submit a crafted form; no authentication or privileged access is required. The vulnerability is not listed in the CISA KEV catalog.