WP Booking System for WordPress, in versions older than 2.1.0.1, fails to sanitize the X‑Forwarded‑For header before storing it and later rendering that value in an administration screen. This omission permits unauthenticated attackers to inject arbitrary JavaScript that will execute within the context of any administrator who views the affected page, potentially compromising the confidentiality, integrity, or availability of the administrative session. The weakness corresponds to the documented class of cross‑site scripting faults.

The vulnerability affects all installations of the WP Booking System plugin deployed on WordPress sites that are running a version prior to 2.1.0.1. No other products or vendors are listed as impacted.

A CVSS score of 8.8 confirms high severity, indicating that the stored XSS can compromise administrator accounts. The low EPSS (<1%) and absence from KEV suggest a moderate immediate threat; however, the straightforward exploitation path warrants prompt remediation.