The Booking Calendar plugin contains an unauthenticated cross‑site scripting flaw in all releases up to 11.4.2. An attacker can inject arbitrary JavaScript that executes in the context of any visitor’s browser. Because the script runs with the page’s privileges, it can steal cookies, deface content, or redirect users to malicious sites. The weakness is a classic input validation failure, classified as CWE‑79.

All WordPress sites running the wpdevelop Booking Calendar plugin version 11.4.2 or older are affected. Users should confirm they are on 11.4.3 or a later release to eliminate the risk.

The CVSS score of 7.1 indicates high severity. The flaw is unauthenticated, meaning any site visitor can trigger it. The EPSS score of 0.0018 shows a very low probability of exploitation in the wild, but the lack of authentication requirement expands the attack surface. The flaw is not listed in the CISA KEV catalog.