A stored cross‑site scripting flaw exists in Frappe ERPNext through the public booking page. Content submitted by an unauthenticated user is saved without neutralization and later rendered as raw HTML inside a privileged user's session. If an attacker injects malicious script, that script runs with the full privileges of the logged‑in user, effectively hijacking the account and enabling arbitrary actions. The weakness is a classic input validation problem categorized as CWE‑79.

The vulnerability affects Frappe ERPNext versions prior to 15.119.1 and all 16.x releases earlier than 16.32.0. Users running any of these legacy releases that expose the public booking feature are susceptible unless they have disabled or removed the functionality.

The CVSS score of 8.6 indicates high severity, while the EPSS score is not available but the lack of any mitigation in the CISA KEV catalog suggests moderate exploit advisory visibility. An unauthenticated attacker can exploit the flaw by simply submitting crafted data on the booking page; the attack requires no additional privileges or network access beyond the exposed web interface. Successful exploitation grants the attacker full control of the affected user's session and local resources.