The WordPress WP Booking System plugin contains a reflected Cross‑Site Scripting flaw that arises from improper neutralization of input during page generation. A crafted request can inject arbitrary JavaScript that is executed in the victim’s browser. The injection is reflected back in the page response and can be used to modify page content, steal authentication cookies, or perform phishing attacks against users who view the page.

All installations of the WP Booking System plugin version 2.1.0.6 or earlier are affected. The vulnerability exists in every release from the earliest known version up to 2.1.0.6, impacting the plugin’s booking form handling and related request processing.

The CVSS score of 7.1 indicates a moderate to high severity for this reflected XSS flaw. The EPSS score is not available, so the likelihood of exploitation is undetermined. The flaw is not listed in CISA’s KEV catalog. Attackers can exploit it simply by sending a crafted request, such as a malicious URL or a form submission, which requires no special privileges or complex conditions and can be carried out by luring a user to visit a malicious link.