The vulnerability arises from insufficient input sanitization that permits attackers to inject malicious scripts into web page content. When stored, these scripts execute on the browsers of any user who views the affected content, potentially enabling account hijacking, defacement, or delivery of malware. This weakness aligns with the standard web-based injection flaw characterized as CWE‑79.

The flaw resides in the wpdevart Booking Calendar and Appointment Booking System WordPress plugin. All released versions up to and including 3.2.36 are compromised, regardless of the specific WordPress installation or user role.

With a CVSS score of 7.1, the threat is considered moderate to high. The exploit likelihood cannot be quantified due to missing EPSS data, but standard XSS exploitation techniques would suffice, especially if an attacker can originate input through the plugin’s booking or appointment interfaces. The vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation as of now.