This vulnerability is a stored cross‑site scripting flaw in the WP Hotel Booking WordPress plugin. It arises from inadequate sanitization and escaping of the ‘widget_search’ shortcode attribute, allowing an authenticated attacker with contributor role or higher to inject malicious JavaScript into a hidden attribute. When a site visitor loads the impacted page, the injected script runs in the visitor’s browser, enabling data theft, session hijacking, or page defacement.

Any WordPress installation running WP Hotel Booking versions up to and including 2.3.2, distributed by thimPress, is affected. All releases prior to 2.3.3 contain the flaw.

The CVSS score of 6.4 denotes moderate severity, while an EPSS score of less than 1 % indicates a low likelihood of exploitation; the vulnerability is not listed in CISA’s KEV catalog. The attack vector requires an authenticated contributor or higher account, after which arbitrary script execution occurs with the victim’s browser privileges, enabling credential theft or further compromise.