Unauthenticated cross‑site scripting is possible in the WP Time Slots Booking Form plugin versions up to 1.2.46. The flaw allows an attacker to inject malicious JavaScript into the plugin’s output, which is then executed by any visitor who views the affected page. This can lead to defacement, theft of user cookies, and the execution of further malware in the context of the site’s users, without requiring authentication.

WordPress sites that have installed the WP Time Slots Booking Form plugin from codepeople at or below version 1.2.46 are affected. Updates starting with 1.2.47 contain the fix.

The CVSS score of 7.1 reflects a moderate to high risk. With an EPSS score of less than 1 %, exploitation likelihood is low but not zero, and the vulnerability is currently not listed in CISA’s KEV catalog. The attack vector is likely a web‑based interaction, and no user authentication is required to deliver the payload.