The Tennis Court Bookings plugin for WordPress contains a stored cross‑site scripting flaw that allows any administrator‑level user to insert arbitrary JavaScript into the plugin’s settings or calendar configuration fields. Because the data is saved to the database without sufficient sanitization or escaping, the injected script will run automatically in any browser that renders the affected page. This weakness is classified as CWE‑79.

WordPress sites that have installed Tennis Court Bookings version 1.2.7 or earlier on a multi‑site network and have the unfiltered_html capability disabled are affected. The flaw can only be used by users with administrator or higher privileges who can access the plugin’s configuration screens.

The CVSS score of 4.4 indicates a moderate severity. The EPSS score is less than 1 %, implying a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. An attacker must possess administrator credentials to insert malicious code; once injected, the payload will execute in the browsers of any user who views the affected page.