The Prenotazioni WordPress plugin allows an unauthenticated user to update plugin settings without authorization or CSRF protection. The plugin fails to escape certain setting values when displaying them, creating a stored XSS vector that can be used to inject arbitrary script into pages viewed by administrators and site visitors. This flaw enables attackers to compromise user browsers, steal credentials, or deface content.

WordPress sites that install the Prenotazioni plugin at or before version 1.7.5. The vulnerability is tied to the plugin itself and affects all installed WordPress sites that are running these or older releases.

Because no authentication is required, the attack can be carried out by any external actor who can send a crafted request to the site. While the CVSS score is 8.8 and EPSS is unavailable, the vulnerability is not listed in KEV; nevertheless, the zero‑auth requirement and persistent nature of the stored payload give this flaw a high attack potential. An attacker can insert scripts that run in the browsers of site administrators or any visitor, leading to potential credential theft, session hijacking, or malicious content delivery. The lack of proper authorization checks also means that the attacker can repeatedly modify the stored values to maintain persistence.