The vulnerability is a stored Cross‑Site Scripting flaw caused by improper neutralization of user input during web page generation. When an attacker submits malicious input that is persisted by the WpBookingly service‑booking‑manager, the input is rendered on subsequent page loads without sufficient escaping, enabling the attacker to execute arbitrary JavaScript in the context of the website as viewed by other users. This can lead to session hijacking, credential theft, defacement or the execution of additional malicious payloads. The flaw is classified as CWE‑79 and scores a moderate CVSS of 6.5.

The issue affects the WordPress WpBookingly plugin (service‑booking‑manager) provided by Magepeople inc. All versions up to and including 1.4.3 are vulnerable. No higher versions are known to be affected.

A moderate CVSS score of 6.5 indicates that exploitation would provide the attacker with significant impact if the plugin is exposed to user input. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that it has not yet been confirmed as widely exploited. The most likely attack vector involves creating or editing a resource through the plugin’s input fields, which then stores the malicious payload and serves it to other visitors. Because the flaw is stored, the attacker does not need to maintain a continuous connection to inject payloads, making the exploitation straightforward once an entry is created.