The Surbma | Booking.com Shortcode plugin contains a stored cross‑site scripting flaw (CWE‑79) caused by insufficient sanitization of user‑supplied attributes in the surbma‑bookingcom shortcode. An authenticated user with contributor or higher privileges can embed arbitrary JavaScript that will run in the browser of any visitor who views a page containing the shortcode. The injected code executes within the site’s context and can perform any action allowed by the victim’s session, potentially leading to data theft, session hijacking or defacement.

All releases of the Surbma | Booking.com Shortcode plugin from the first version up to and including version 2.1 are affected. The vulnerability is limited to sites running WordPress with this plugin installed and that provide contributor‑level or higher user roles to any account. Core WordPress and other plugins are not impacted.

The CVSS score of 6.4 denotes a moderate severity. Because the flaw requires authenticated contributor or higher access, it is not exploitable by unauthenticated attackers. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. The likely attack path involves an attacker using the WordPress content editor to edit a post or page, inserting malicious attributes into the shortcode, which then causes the script to execute when other users load the page.