The WP Booking System WordPress plugin before version 2.1.0.3 does not validate or escape the booking_id parameter before reflecting it back in an administrative page. This omission allows an attacker to inject arbitrary JavaScript that is executed in the context of an administrator’s browser, potentially compromising credentials, defacing the site, or facilitating further attacks.

WordPress sites running the WP Booking System plugin with any version earlier than 2.1.0.3 are affected, regardless of other site configuration. The vulnerability is present in all installations using the booking_id parameter without proper sanitisation.

The attack vector is application‑level: an attacker crafts a URL containing malicious content in the booking_id parameter and convinces a privileged user to visit it, or an attacker with direct access to the admin page can exploit the bug. The CVSS score is 7.1 and the EPSS score is < 1%. The vulnerability is not listed in CISA KEV. Because the flaw requires privilege to an administrator, the reach is limited to sites where such accounts are used, but the impact can be severe if successful.