The WP Hotel Booking plugin for WordPress contains a reflected cross‑site scripting flaw in the publicly accessible 'check_in_date' and 'check_out_date' parameters. Unauthenticated attackers can craft a URL that injects arbitrary client‑side script into the page response. If a victim clicks the link, the script executes in their browser, allowing the attacker to steal cookies, hijack sessions, deface content, or carry out other client‑side attacks. The weakness originates from insufficient input sanitization and output escaping, which is a classic example of a Cross‑Site Scripting vulnerability (CWE‑79).

All WordPress sites that have the ThimPress WP Hotel Booking plugin installed at version 2.3.1 or earlier are affected. Based on the description, it is inferred that this plugin is used on a variety of hotel‑booking sites, meaning that many visitors across multiple sites could potentially encounter the vulnerable parameters.

The CVSS score of 6.1 indicates moderate severity. The EPSS score of less than 1 % suggests that exploitation is currently unlikely but not impossible. Because the flaw is reflected and requires no authentication, the attacker only needs to lure a target into opening a crafted link, making the attack vector low effort. The vulnerability is not listed in CISA’s KEV catalog, indicating there are no known widespread exploits at this time.