The Booking Package plugin for WordPress is vulnerable to stored Cross‑Site Scripting via the id parameter in all releases up to and including 1.7.29 due to insufficient input sanitization and output escaping; this flaw allows an authenticated user with contributor‑level privileges or higher to inject arbitrary scripts that run whenever a page containing the injected content is accessed, potentially facilitating session hijacking, defacement, or the execution of malicious code.

All WordPress sites that employ the Booking Package plugin, developed by masaakitanaka, and running any version up to and including 1.7.29 are affected. Versions 1.7.30 and later are not vulnerable per the vendor’s release notes.

The vulnerability has a CVSS score of 6.4, indicating moderate severity, and an EPSS score of less than 1% suggesting a low current probability of exploitation. It is not listed in CISA’s KEV catalog. Because exploitation requires authenticated contributor‑level access, it is not a public vulnerability, but the potential impact of script injection on legitimate users and the ease of achieving it once credentials are obtained warrant attention. The likely attack vector is application‑level, leveraging the plugin’s shortcode processing to embed malicious scripts (this inference is drawn from the description of stored XSS via the 'id' attribute). The flaw could be leveraged stealthily with minimal obvious indications of compromise.