The Bookero.pl WordPress reservation system plugin allows an authenticated user with contributor-level or higher privileges to inject arbitrary JavaScript through the hide_products and filter_products attributes of its bookero_products shortcode. The plugin concatenates the raw attribute value directly into an inline <script> block without any sanitization or escaping, resulting in a stored cross‑site scripting flaw. When a page containing the shortcode is rendered, the malicious script executes in the browsers of all visitors. The underlying weakness is identified as CWE‑79, reflecting the inadequate sanitization of user input.

The vulnerability affects the safistudio Bookero.pl – system rezerwacji online WordPress plugin. All releases up to and including version 2.2 contain the flaw. Any WordPress site that hosts one of these releases and permits or edit content that includes the bookero_products shortcode is vulnerable.

The CVSS v3.1 score of 6.4 classifies this issue as medium severity. Its EPSS score of less than 1% and absence in the CISA KEV catalog suggest that widespread exploitation is currently unlikely. However, the attack requires only legitimate contributor access, and the flaw persists long after injection until the offending content is removed or the shortcode is disabled.